Aim vulnerable to Cross-site Scripting

HIGH 8.8CVE-2025-51464 · GHSA-gmvv-rj92-9w35 · PYSEC-2026-1087 · Published 22/07/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
aim PyPI	`≤ 3.30.0.dev20250611`	No fix yet
aim aimstack	`= 3.28.0`	No fix yet

Description

Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox restrictions prevent JavaScript execution via pyodide.code.run_js().

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-51464 · ADVISORY
aimhubio/aim#3333 · WEB
aimhubio/aim · PACKAGE
gecko.security/blog/cve-2025-51464 · WEB
pypi.org/project/aim · PACKAGE
GitHub Advisory GHSA-gmvv-rj92-9w35 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free