CVE-2025-5321 is a medium severity (CVSS 6.3) privilege issue in aimhubio Aim, the open source experiment tracker, in versions up to 3.29.1. The RestrictedPythonQuery function in the run view handler can be abused remotely. The vendor did not respond, and no fix is listed, so restrict who can reach the server.
What's affected
The record names aimhubio aim up to 3.29.1 and the function RestrictedPythonQuery in /aim/storage/query.py, part of the run_view object handler. It says manipulating an argument leads to elevated privileges, which it classifies under CWE-264 and CWE-265.
The record says the attack can be started remotely, that the exploit has been disclosed to the public, and that the vendor was contacted early about the disclosure but did not respond in any way. The CVSS vector requires low privileges, which means an attacker needs some access to the Aim server first.
No fixed version is named in the record or in the references, a public gist and VulDB entries. I could not confirm one, so check the Aim releases page and its security notices yourself.
How to check if you're exposed
Find where Aim runs in your organisation. Machine learning teams often start an Aim server on a shared GPU host or in a notebook environment without telling anyone. Check the installed version:
pip show aim
A version of 3.29.1 or lower is in scope. Then check how the Aim UI and tracking server are exposed. If the web interface listens on a network address and has no authentication in front of it, anybody who can reach it has the low level of access that the vector assumes.
Look at your reverse proxy and firewall settings for the Aim ports, and at who has accounts on the host.
What to do now
- Inventory every Aim installation and note its version and who can reach its web interface.
- Check the Aim project for a release newer than 3.29.1 that addresses this issue, and update if one exists.
- Put the Aim server behind authentication and a VPN or allow list. Do not expose it to the internet.
- Run Aim under a dedicated account with no access to cloud credentials or production data.
- Treat any query feature that evaluates Python as sensitive, and limit who can use it.
Why it matters
RestrictedPythonQuery suggests a design where users write small Python expressions to filter runs, and the code tries to restrict what those expressions can do. Restricted evaluation of Python is hard to get right, because the language offers many routes to reach objects and functions that the restriction was meant to block. The record describes the result as elevated privileges.
For a team that uses Aim, the practical risk depends on who can reach the server and on what the server account can see. Experiment trackers often live on hosts with datasets, model files and cloud keys. The CVE is not on the CISA Known Exploited Vulnerabilities list, though the record notes that a public exploit exists. Network controls are the strongest defence while no fix is available.
Quick check
Has the vendor fixed it?
The record says the vendor did not respond to the disclosure, and no fix is listed. Check the project for newer releases.
Sources
Last reviewed: 18 October 2026.
