CVE-2025-5321: aimhubio aim run_view Object query.py RestrictedPythonQuery privilege escalation

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-29 · updated 2026-06-17
Weakness: CWE-264

Description

A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Abfrage leads to erweiterte Rechte. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

aimhubio/aim: through 3.29.1

References

https://gist.github.com/superboy-zjc/1fc4747a0ac77a1edc8c32e1d4edc54c
https://vuldb.com/?ctiid.310492
https://vuldb.com/?id.310492
https://vuldb.com/?submit.580253

Get alerted when CVE-2025-5321 or the next vulnerability affects your stack