PT-2025-30441 · Unknown+1 · Aimhubio Aim+1

Geckosecurity · CVE-2025-51464 · Published 2025-07-22 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions aimhubio Aim versions 3.28.0

Description A cross-site scripting (XSS) issue exists in aimhubio Aim 3.28.0. Remote attackers can execute arbitrary JavaScript in a victim’s browser by submitting malicious Python code to the /api/reports endpoint. The submitted Python code is interpreted and executed by Pyodide when the report is viewed. Insufficient sanitisation or sandbox restrictions allow JavaScript execution via pyodide.code.run js().

Recommendations aimhubio Aim version 3.28.0: As a temporary workaround, consider restricting access to the /api/reports endpoint to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-51464

GHSA-GMVV-RJ92-9W35

PYSEC-2026-1087

Affected Products

Pyodide

Aimhubio Aim

References · 14

• 🔥 https://github.com/aimhubio/aim/pull/3333 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/51xxx/CVE-2025-51464.json · Exploit
• 🔥 https://gecko.security/blog/cve-2025-51464 · Exploit
• https://osv.dev/vulnerability/CVE-2025-51464 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gmvv-rj92-9w35 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-51464 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-1087 · Vendor Advisory
• https://github.com/aimhubio/aim · Note
• https://github.com/advisories/GHSA-gmvv-rj92-9w35 · Note
• https://twitter.com/CVEnew/status/1947714894390038858 · Twitter Post
• https://t.me/cvetracker/28403 · Telegram Post
• https://t.me/cveNotify/129882 · Telegram Post
• https://t.me/CVEtracker/28403 · Telegram Post
• https://pypi.org/project/aim · Note