Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

aimhubio/aim

              main @ 6e098e3
            

Fixes

CVEs

CRITICAL

Peak severity

55.6%

Coverage

Highlights

Path Traversal: 4 prior fixes. Scrutinize any change in this area.

aim/web/api/views.py: most-fixed (4 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: The application repeatedly failed to properly resolve and validate files served dynamically. Path traversal in the static file server allowed reading arbitrary system files because input paths were not resolved relative to the root before validation. This pattern is also visible in historical CVEs targeting run_hash concatenation.

Arbitrary Code Execution: Remote gRPC metadata was used to dynamically import modules and look up attributes via getattr, allowing remote attackers to trigger arbitrary code execution during client-side exception handling. Secure designs must use strict allowlists of safe exception classes instead of dynamic imports.

Auth Bypass: The SDK permitted creation of new runs using custom user-defined hashes, bypassing authentication and data integrity structures by allowing attackers to overwrite or tamper with existing runs. Restricting run creation to strictly validated/generated run hashes prevents state poisoning.