EUVD-2024-41598

Malicious code in bioql PyPI...

EUVD-2024-27316

Malicious code in bioql PyPI...

EUVD-2024-41600

Malicious code in bioql PyPI...

EUVD-2024-41599

Malicious code in bioql PyPI...

EUVD-2024-50261

Malicious code in bioql PyPI...

EUVD-2023-35671

Malicious code in bioql PyPI...

EUVD-2025-6999

Malicious code in bioql PyPI...

EUVD-2025-6926

Malicious code in bioql PyPI...

EUVD-2024-1169

Malicious code in bioql PyPI...

EUVD-2025-6933

Malicious code in bioql PyPI...

EUVD-2024-2234

Malicious code in bioql PyPI...

Malicious code in @zalastax/nolb-aim (npm)

The package @zalastax/nolb-aim was found to contain malicious code...

MAL-2025-43111 Malicious code in @zalastax/nolb-aim (npm)

The package @zalastax/nolb-aim was found to contain malicious code...

MAL-2025-9740 Malicious code in @zalastax/nolb-_aim (npm)

The package @zalastax/nolb-aim was found to contain malicious code...

CVE-2025-51463

Path Traversal in restorerunbackup in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file submitted to the runinstruction API, which is extracted without path validation during restoration...

GHSA-GMVV-RJ92-9W35 Aim vulnerable to Cross-site Scripting

Cross-site Scripting XSS in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox...

CVE-2025-51464

Cross-site Scripting XSS in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox...

Cross-site Scripting (XSS)

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /api/reports endpoint, which processes user-submitted Python code that is interpreted and executed by the function pyodide.code.runjs...

CVE-2025-51463

Path Traversal in restorerunbackup in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file submitted to the runinstruction API, which is extracted without path validation during restoration...

CVE-2025-51463

The Aim experiment tracker (specifically version 3.28.0 ) is vulnerable to a path traversal (or directory traversal) vulnerability in the restore_run_backup() function. An attacker can exploit this by submitting a crafted backup tar file to the run_instruction API; because the file is extracted w...