CVE-2025-51464 | THREATINT

Description

Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox restrictions prevent JavaScript execution via pyodide.code.run_js().

PUBLISHED Reserved 2025-06-16 | Published 2025-07-22 | Updated 2025-07-22 | Assigner mitre

References

github.com/aimhubio/aim

github.com/aimhubio/aim/pull/3333

www.gecko.security/blog/cve-2025-51464

cve.org (CVE-2025-51464)

nvd.nist.gov (CVE-2025-51464)

Download JSON