Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-8238Unrestricted Code Execution in aimhubio/aim
Medium 5.9
In plain English
A medium-severity security flaw in aimhubio/aim from aimhubio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Official description
In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safer_getattr() function from RestrictedPython. This version does not protect against the str.format_map() method, allowing an attacker to leak server-side secrets or potentially gain unrestricted code execution. The vulnerability arises because str.format_map() can read arbitrary attributes of Python objects, enabling attackers to access sensitive variables such as os.environ. If an attacker can write files to a known location on the Aim server, they can use str.format_map() to load a malicious .dll/.so file into the Python interpreter, leading to unrestricted code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | aim | no fix listed | GHSA-r229-5wgf-f28g |
| PyPI | aim | no fix listed | PYSEC-2026-1094 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| aimhubio | aimhubio/aim | unspecified – through latest |
Weakness: CWE-1336 · Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N