PT-2025-12220 · Aimhubio · Aim

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-8101

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.23.0

Description A stored cross-site scripting (XSS) issue exists in the Text Explorer component due to the use of dangerouslySetInnerHTML without proper sanitization, allowing arbitrary JavaScript execution when rendering tracked texts. This can be exploited by injecting malicious HTML content during the training process, which is then rendered unsanitized in the Text Explorer.

Recommendations For aimhubio/aim version 3.23.0, consider disabling the use of dangerouslySetInnerHTML in the Text Explorer component until a patch is available, or ensure proper sanitization of the content to prevent arbitrary JavaScript execution. Restrict access to the Text Explorer component to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-8101

Affected Products

Aim

References · 5

• 🔥 https://huntr.com/bounties/60cf2b93-a9a2-435e-a222-3d6abde26adb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-8101 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8101 · Vendor Advisory
• https://twitter.com/CVEnew/status/1902670979546878112 · Twitter Post
• https://t.me/cvenotify/115466 · Telegram Post