GHSA-gp5h-f9c5-8355

Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution

Source: GitHub Advisory Database (reviewed) Low CVE-2025-5321

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	aim	<= 3.29.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Query leads to sandbox issue. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-5321 advisory
https://gist.github.com/superboy-zjc/1fc4747a0ac77a1edc8c32e1d4edc54c web
https://github.com/aimhubio/aim package
https://vuldb.com/?ctiid.310492 web
https://vuldb.com/?id.310492 web
https://vuldb.com/?submit.580253 web