Vulnerability · Published May 29, 2025 · Assigned by VulDB

CVE-2025-5321aimhubio aim run_view Object query.py RestrictedPythonQuery privilege escalation

Medium 6.3

In plain English

A medium-severity security flaw in aim from aimhubio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.6%top 48.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Abfrage leads to erweiterte Rechte. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	aim	no fix listed	GHSA-gp5h-f9c5-8355
PyPI	aim	no fix listed	PYSEC-2026-1088

Affected products (as reported)

Vendor	Product	Versions
aimhubio	aim	3.29.03.29.1

Weakness: CWE-265, CWE-264 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

VDB-310492 | aimhubio aim run_view Object query.py RestrictedPythonQuery privilege escalation vdb-entry, technical-description
VDB-310492 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #580253 | aim 3.29.1 Sandbox Issue third-party-advisory
https://gist.github.com/superboy-zjc/1fc4747a0ac77a1edc8c32e1d4edc54c exploit