CVE-2024-8238

In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safergetattr() function from RestrictedPython. This version does not protect against the str.formatmap() method, allowing an attacker to leak server-side secrets or potentially gain unrestricted code execution. The vulnerability arises because str.formatmap() can read arbitrary attributes of Python objects, enabling attackers to access sensitive variables such as os.environ. If an attacker can write files to a known location on the Aim server, they can use str.formatmap() to load a malicious .dll/.so file into the Python interpreter, leading to unrestricted code execution.