CVE-2025-51464 Aim vulnerable to Cross-site Scripting

What is CVE-2025-51464?

CVE-2025-51464 is a high-severity cross-site scripting vulnerability in n/a, published on 22 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox restrictions prevent JavaScript execution via pyodide.code.run_js().

Weakness: CWE-79

Which versions are affected by CVE-2025-51464?

3 open source packages ship an affected version, including aim. It affects 1 product.

Products include Aimstack Aim.

How do I fix CVE-2025-51464?

No fix has been published for CVE-2025-51464 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-51464 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-51464 exists.

Other vulnerabilities in n/a

• CVE-2024-6396 Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim Critical 9.8
• CVE-2024-2195 Remote Code Execution in aimhubio/aim Critical 9.8
• CVE-2024-6829 Arbitrary File Overwrite through tarfile-extraction in aimhubio/aim Critical 9.1
• CVE-2024-8769 Arbitrary File Deletion via Relative Path Traversal in aimhubio/aim Critical 9.1
• CVE-2024-2196 CSRF Vulnerability in aimhubio/aim High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gmvv-rj92-9w35, PYSEC-2026-1087.