EUVD-2025-22328

Malicious code in bioql PyPI...

EUVD-2024-54479

Malicious code in bioql PyPI...

EUVD-2024-50261

Malicious code in bioql PyPI...

EUVD-2024-41597

Malicious code in bioql PyPI...

EUVD-2024-41600

Malicious code in bioql PyPI...

MAL-2025-43111 Malicious code in @zalastax/nolb-aim (npm)

The package @zalastax/nolb-aim was found to contain malicious code...

Malicious code in @zalastax/nolb-aim (npm)

The package @zalastax/nolb-aim was found to contain malicious code...

MAL-2025-9740 Malicious code in @zalastax/nolb-_aim (npm)

The package @zalastax/nolb-aim was found to contain malicious code...

CVE-2025-51463

Path Traversal in restorerunbackup in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file submitted to the runinstruction API, which is extracted without path validation during restoration...

GHSA-GMVV-RJ92-9W35 Aim vulnerable to Cross-site Scripting

Cross-site Scripting XSS in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox...

CVE-2025-51464

Cross-site Scripting XSS in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox...

Cross-site Scripting (XSS)

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /api/reports endpoint, which processes user-submitted Python code that is interpreted and executed by the function pyodide.code.runjs...

ado-sfttrainer (>=1.0.1, <=1.8.8), aim-mlflow (>=0.1.0, <=0.2.1) +26 more potentially affected by CVE-2025-51464 via aim (>=3.17.4, <=4.0.3)

aim PYPI version =3.17.4, =1.0.1, =0.1.0, =0.1.0, =0.0.1, =4.46.1, =0.0.1, =0.0.3, =0.0.1, =1.1.5, =0.1.1, =0.22.0, =0.0.1, =0.0.1, =2.0.1, =2.0.7 and more Source cves: CVE-2025-51464 Source advisory: SNYK:PYTHON-AIM-10878170...

CVE-2025-51463

Path Traversal in restorerunbackup in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file submitted to the runinstruction API, which is extracted without path validation during restoration...

ado-sfttrainer (>=1.0.1, <=1.8.8), aim-mlflow (>=0.1.0, <=0.2.1) +26 more potentially affected by CVE-2025-51463 via aim (>=3.17.4, <=4.0.3)

aim PYPI version =3.17.4, =1.0.1, =0.1.0, =0.1.0, =0.0.1, =4.46.1, =0.0.1, =0.0.3, =0.0.1, =1.1.5, =0.1.1, =0.22.0, =0.0.1, =0.0.1, =2.0.1, =2.0.7 and more Source cves: CVE-2025-51463 Source advisory: SNYK:PYTHON-AIM-10875510...

CVE-2025-51463

Path Traversal in restorerunbackup in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file submitted to the runinstruction API, which is extracted without path validation during restoration...

CVE-2025-51464

Cross-site Scripting XSS in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox...

CVE-2025-51463: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in restorerunbackup in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file submitted to the runinstruction API, which is extracted without path validation during restoration...

CVE-2025-51463

The Aim experiment tracker (specifically version 3.28.0 ) is vulnerable to a path traversal (or directory traversal) vulnerability in the restore_run_backup() function. An attacker can exploit this by submitting a crafted backup tar file to the run_instruction API; because the file is extracted w...

CVE-2025-51464

The aimhubio Aim 3.28.0 package is vulnerable to Cross-site Scripting (XSS) via the /api/reports endpoint. The root cause is a lack of sanitization or sandbox restrictions when processing user-submitted Python code, which is interpreted and executed by Pyodide using the pyodide.code.run_js() func...