CVE-2025-51464

HIGH

aimstack aim 3.28.0 - Stored Cross-Site Scripting via /api/reports Endpoint

Title source: llm
STIX 2.1

Description

Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox restrictions prevent JavaScript execution via pyodide.code.run_js().

References (3)

Core 3
Core References
Exploit, Third Party Advisory
https://www.gecko.security/blog/cve-2025-51464

Scores

CVSS v3 8.8
EPSS 0.0188
EPSS Percentile 83.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-79
Status published
Products (2)
aimstack/aim 3.28.0
pypi/aim 0PyPI
Published Jul 22, 2025
Tracked Since Feb 18, 2026