SCA: security update for aim (GHSA-75px-35p4-qq6h)

critical Tenable Cloud Security Plugin ID 477519

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the `tarfile.extractall()`
function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host
server. The attacker can control `repo.path` and `run_hash` to bypass directory existence checks and
extract files to unintended locations, potentially overwriting critical files. This can lead to arbitrary
data being written to arbitrary locations on the remote tracking server, which could be used for further
attacks such as writing a new SSH key to the target server. (CVE-2024-6829)

Solution

There is no known solution at this time.

Plugin Details

Severity: Critical

ID: 477519

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/27/2026

Updated: 10/27/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.37

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C

CVSS Score Source: CVE-2024-6829

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/20/2025

Vulnerability Publication Date: 3/20/2025

Reference Information

CVE: CVE-2024-6829

cwe: CWE-73

Detections

Analytics