Answer in brief
CVE-2024-6829 records a Critical severity (CVSS 9.1) vulnerability in Aim External Control of File Name or Path vulnerability. The current sources do not mark it as known exploited. The current feed maps aim (pip), aim (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps aim (pip), aim (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| aimpip | <=3.19.3 | Not reported |
| aimpypi | >=0 | Not reported |
Published upstream
Mar 20, 2025
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Oct 26, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Oct 26, 2026
A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the `tarfile.extractall()` function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host server. The attacker can control `repo.path` and `run_hash` to bypass directory existence checks and extract files to unintended locations, potentially overwriting critical files. This can lead to arbitrary data being written to arbitrary locations on the remote tracking server, which could be used for further attacks such as writing a new SSH key to the target server.
Quoted source text, attributed separately from HOL analysis.