Aim Stored Cross-site Scripting Vulnerability

MEDIUM 5.4CVE-2024-6578 · GHSA-p9f2-jg9w-cx69 · PYSEC-2026-1092 · Published 29/07/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
aim PyPI	`≤ 3.19.3`	No fix yet
aim aimstack	`= 3.19.3`	No fix yet

Description

A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the dangerouslySetInnerHTML function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.

NVD description

A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the `dangerouslySetInnerHTML` function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.

References

nvd.nist.gov/vuln/detail/CVE-2024-6578 · ADVISORY
aimhubio/aim · PACKAGE
huntr.com/bounties/5b1ebc67-5346-44aa-b8b8-3c1c09d79680 · WEB
pypi.org/project/aim · PACKAGE
GitHub Advisory GHSA-p9f2-jg9w-cx69 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

aim

PyPI

≤ 3.19.3

No fix yet

aim

aimstack

= 3.19.3

No fix yet

Description

NVD description

A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the `dangerouslySetInnerHTML` function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.