PYSEC-2026-1094 Aim Improper Access Control

In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safergetattr function from RestrictedPython. This version does not protect against the str.formatmap method, allowing an attacker to leak server-side secrets or potentially gain unrestricted code execution...

Access Control Bypass

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Access Control Bypass due to the use of an outdated safergetattr function from RestrictedPython which fails to block the str.formatmap method. An attacker can leak...

Information Disclosure

AccessControl is vulnerable to Information Disclosure. The vulnerability is due to the formatmap function which allows attackers controlling the format string to read objects accessible via getattr and getitem which can result a critical information disclosure...

python-jinja2: str.format_map allows sandbox escape

A flaw was found in Jinja. Python string formatting could allow an attacker to escape the sandbox. The highest threat from this vulnerability is to data confidentiality and integrity and system availability...