Homepage
About Snyk

aim@4.0.0a16 vulnerabilities

A super-easy way to record, search and compare AI experiments.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the aim package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • C
Improper Control of Generation of Code ('Code Injection')

aim is a super-easy way to record, search and compare AI experiments.

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') due to improper restriction of user access to the RunView object. An attacker can execute arbitrary commands on the server, potentially leading to full system compromise by exploiting the query parameter in the /api/runs/search/run/ endpoint.

How to fix Improper Control of Generation of Code ('Code Injection')?

There is no fixed version for aim.

[3.0.0,)
  • H
Cross-Site Request Forgery (CSRF)

aim is a super-easy way to record, search and compare AI experiments.

Affected versions of this package are vulnerable to Cross-Site Request Forgery (CSRF) due to the lack of CSRF and CORS protection in the aim dashboard. An attacker can exploit this by tricking a user into executing a malicious script that sends unauthorized requests to the aim server, leading to potential data loss and unauthorized data manipulation.

How to fix Cross-Site Request Forgery (CSRF)?

There is no fixed version for aim.

[0,)
Go back to all versions of this package