CVE-2024-8238 - CVE House
Back to Database
Status published Medium CVE-2024-8238

Unrestricted Code Execution in aimhubio/aim

Vulnerability Description

In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safer_getattr() function from RestrictedPython. This version does not protect against the str.format_map() method, allowing an attacker to leak server-side secrets or potentially gain unrestricted code execution. The vulnerability arises because str.format_map() can read arbitrary attributes of Python objects, enabling attackers to access sensitive variables such as os.environ. If an attacker can write files to a known location on the Aim server, they can use str.format_map() to load a malicious .dll/.so file into the Python interpreter, leading to unrestricted code execution.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8238

Credits & Attribution

No credits recorded in the NVD database.

References

More from aimhubio

View All →
CVE-2025-5321
aimhubio aim run_view Object query.py RestrictedPythonQuery privilege escalation
Medium 5.3
CVE-2025-0190
Denial of Service in aimhubio/aim
High 7.5
CVE-2025-0189
Denial of Service in aimhubio/aim
High 7.5
CVE-2024-8863
aimhubio aim Text Explorer textbox.tsx dangerouslySetInnerHTML cross site scripting
Medium 5.3
CVE-2024-8769
Arbitrary File Deletion via Relative Path Traversal in aimhubio/aim
Critical 9.1

Affected Vendor

Affected Software

aimhubio/aim
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: October 15th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-1336

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.