CVE-2024-8101

MEDIUM

aimstack aim 3.23.0 - Stored Cross-Site Scripting in Text Explorer via dangerouslySetInnerHTML

Title source: llm

Description

A stored cross-site scripting (XSS) vulnerability exists in the Text Explorer component of aimhubio/aim version 3.23.0. The vulnerability arises due to the use of `dangerouslySetInnerHTML` without proper sanitization, allowing arbitrary JavaScript execution when rendering tracked texts. This can be exploited by injecting malicious HTML content during the training process, which is then rendered unsanitized in the Text Explorer.

References (1)

Core 1

Core References

Exploit

https://huntr.com/bounties/60cf2b93-a9a2-435e-a222-3d6abde26adb

Scores

CVSS v3 6.1

EPSS 0.0040

EPSS Percentile 32.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

aimstack/aim 3.23.0

Published Mar 20, 2025

Tracked Since Feb 18, 2026