CVE-2024-8238

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-8238
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-8238.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-8238
Aliases
Published
2025-03-20T10:11:09.622Z
Modified
2026-07-15T01:49:14.197730527Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Unrestricted Code Execution in aimhubio/aim
Details

In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safergetattr() function from RestrictedPython. This version does not protect against the str.formatmap() method, allowing an attacker to leak server-side secrets or potentially gain unrestricted code execution. The vulnerability arises because str.formatmap() can read arbitrary attributes of Python objects, enabling attackers to access sensitive variables such as os.environ. If an attacker can write files to a known location on the Aim server, they can use str.formatmap() to load a malicious .dll/.so file into the Python interpreter, leading to unrestricted code execution.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8238.json",
    "cwe_ids": [
        "CWE-1336"
    ],
    "cna_assigner": "@huntr_ai"
}
References

Affected packages

Git / github.com/aimhubio/aim

Affected ranges

Type
GIT
Repo
https://github.com/aimhubio/aim
Events
Introduced
88ac143708fad8737094b74e9e5b25689d18f1a6
Last affected
88ac143708fad8737094b74e9e5b25689d18f1a6
Database specific 
{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:aimstack:aim:3.22.0:*:*:*:*:python:*:*",
    "extracted_events": [
        {
            "introduced": "3.22.0"
        },
        {
            "last_affected": "3.22.0"
        }
    ]
}

Affected versions

3.*
3.22.0
v3.*
v3.22.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-8238.json"