CVE-2025-51464: Aim vulnerable to Cross-site Scripting

The vulnerability, identified as CVE-2025-51464, is a Cross-site Scripting (XSS) flaw in the Aim platform. The core of the issue lies in the application's failure to sanitize user-submitted Python code that is intended for inclusion in reports. This unsanitized code is later executed by the Pyodide engine in the browser when a user views a report, allowing for arbitrary JavaScript execution.

The investigation into the provided patch, commit 308edd91a6a0208ae7af36807c5a795af68bb303, reveals the exact point of failure and the subsequent remediation. The patch introduces a new validation function, validate_code_safety, into aim/web/api/reports/views.py. This function is designed to detect and block potentially malicious code containing calls like pyodide.code.run_js().

The critical change is the application of this validation function within two specific API endpoint handlers in the same file:

1. reports_post_api: This function is responsible for creating new reports. Prior to the patch, it directly accepted user input from request_data.code and stored it. The patch integrates validate_code_safety to check the code before it is saved.

2. reports_put_api: This function handles the updating of existing reports. It was similarly flawed, allowing an attacker to inject malicious code into an existing report. The patch applies the same validation logic to the update process.

These two functions served as the entry points for the malicious code. By not validating the input, they permitted an attacker to store a payload. While the actual execution (the "sink") happens on the frontend in a component like Board.tsx (as noted in the pull request description), the identified functions are the vulnerable ones from a backend perspective because they are responsible for processing and storing the untrusted, malicious input. The applied fix addresses the vulnerability at the source, preventing the malicious data from ever entering the system.