Listen to this Post
How the CVE Works
The vulnerability exists in Aim 3.28.0 where user-supplied Python code submitted to `/api/reports` is processed by Pyodide without proper sanitization. Attackers can craft malicious Python code containing `pyodide.code.run_js()` calls to execute arbitrary JavaScript when victims view generated reports. The lack of input validation and output encoding allows XSS payloads to persist and execute in the context of the victim’s browser session. This occurs because Pyodide’s JavaScript execution bridge isn’t restricted by sandboxing or content security policies.
DailyCVE Form
Platform: Aim
Version: 3.28.0
Vulnerability: XSS
Severity: Moderate
Date: Jul 22, 2025
Prediction: Patch by Aug 15, 2025
What Undercode Say
import pyodide
pyodide.code.run_js("malicious_code")
POST /api/reports HTTP/1.1
Host: vulnerable-aim-instance
Content-Type: application/json
{"code":"pyodide.code.run_js('alert(1)')"}
How Exploit
1. Craft Python payload
2. Submit to `/api/reports`
3. Victim views report
4. JS executes
Protection from this CVE
1. Input sanitization
2. Output encoding
3. CSP headers
Impact
1. Session hijacking
2. DOM manipulation
3. CSRF escalation
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
