CVE-2024-2195 Remote Code Execution in aimhubio/aim

What is CVE-2024-2195?

CVE-2024-2195 is a critical code injection vulnerability in aimhubio/aim, published on 10 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affecting versions >= 3.0.0. The vulnerability resides in the `run_search_api` function of the `aim/web/api/runs/views.py` file, where improper restriction of user access to the `RunView` object allows for the execution of arbitrary code via the `query` parameter. This issue enables attackers to execute arbitrary commands on the server, potentially leading to full system compromise.

Weakness: CWE-94

Which versions are affected by CVE-2024-2195?

3 open source packages ship an affected version, including aim. It affects 1 product.

Products include Aimstack Aim.

How do I fix CVE-2024-2195?

No fix has been published for CVE-2024-2195 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-2195 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2195 exists.

Other vulnerabilities in aimhubio/aim

• CVE-2024-6396 Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim Critical 9.8
• CVE-2024-6829 Arbitrary File Overwrite through tarfile-extraction in aimhubio/aim Critical 9.1
• CVE-2024-8769 Arbitrary File Deletion via Relative Path Traversal in aimhubio/aim Critical 9.1
• CVE-2025-51464 Aim vulnerable to Cross-site Scripting High 8.8
• CVE-2024-2196 CSRF Vulnerability in aimhubio/aim High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mxvw-cj37-8g2h, PYSEC-2026-260.