Aim vulnerable to Cross-site Scripting

Cross-site Scripting XSS in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox...

CVE-2025-51464

The experiment tracker aimhubio Aim version 3.28.0 is vulnerable to a Cross-site Scripting (XSS) flaw in the /api/reports endpoint. The root cause is a lack of sanitization or sandbox restrictions, allowing remote attackers to submit malicious Python code that is interpreted by Pyodide . When a r...