CVE-2025-51464: Aim Package Vulnerable to Cross-site Scripting (XSS)
Summary
CVE-2025-51464: Aim vulnerable to Cross-site Scripting. Affects aim versions < 3.30.0.dev20250611. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Aim package, available on PyPI, is designed for data visualization and analysis, allowing users to create interactive reports and dashboards. It leverages Pyodide to execute Python code in the browser, enabling seamless integration of Python functionalities in web applications. However, this capability also introduces security risks, particularly regarding user input handling and code execution.
Vulnerability Detail
The vulnerability identified as CVE-2025-51464 is a Cross-site Scripting (XSS) flaw in Aim version 3.28.0. It allows remote attackers to execute arbitrary JavaScript in victims' browsers through malicious Python code submitted to the /api/reports endpoint. This code is interpreted and executed by Pyodide when the report is viewed, leading to potential data theft, session hijacking, or other malicious activities. The lack of sanitization or sandbox restrictions around the pyodide.code.run_js() function exacerbates the risk, making it easier for attackers to exploit this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization on the server-side to filter out potentially harmful JavaScript code before processing user inputs. However, this is not a complete solution and should be replaced with an update to the patched version as soon as possible.
Conclusion
The CVE-2025-51464 vulnerability in the Aim package poses significant security risks due to its XSS nature, allowing attackers to execute arbitrary JavaScript in users' browsers. Users are strongly advised to update to the latest patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for aim →
FAQ
CVE-2025-51464 is a vulnerability in the Aim package that allows for Cross-site Scripting (XSS), enabling attackers to execute arbitrary JavaScript in users' browsers.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities. Visit Vulert Scanner to use the Vulert playground without signup.
The risks include data theft, session hijacking, and the potential for attackers to execute malicious scripts in the context of the victim's browser.
Yes, the latest patched version of the Aim package is 3.30.0.dev20250611. Users should upgrade to this version to mitigate the vulnerability.
If an immediate update is not possible, implement server-side input validation and sanitization to filter out harmful JavaScript code as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for aim.
