What is GHSA-gmvv-rj92-9w35?

GHSA-gmvv-rj92-9w35 is a security advisory published by GitHub Security Advisories with Medium severity. Aim vulnerable to Cross-site Scripting

Which CVE IDs does GHSA-gmvv-rj92-9w35 cover?

GHSA-gmvv-rj92-9w35 covers the following CVE IDs: CVE-2025-51464. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-gmvv-rj92-9w35?

GHSA-gmvv-rj92-9w35 affects 1 product, including: pip/aim:\u003c= 3.30.0.dev20250611.

GHSA-gmvv-rj92-9w35Medium

Aim vulnerable to Cross-site Scripting

Vendor

GitHub Security Advisories

Published

July 22, 2025

Last Modified

July 22, 2025

🔗 CVE IDs covered (1)

CVE-2025-51464 →

📋 Description

Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox restrictions prevent JavaScript execution via pyodide.code.run_js().

🎯 Affected products1

pip/aim:<= 3.30.0.dev20250611

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-51464
https://github.com/aimhubio/aim/pull/3333
https://github.com/aimhubio/aim
https://www.gecko.security/blog/cve-2025-51464
https://github.com/advisories/GHSA-gmvv-rj92-9w35