CVE-2024-2195: 
Python vulnerability analysis and mitigation

A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, affecting versions >= 3.0.0. The vulnerability, tracked as CVE-2024-2195, was discovered in the /api/runs/search/run/ endpoint. The issue was disclosed on April 10, 2024 (NVD).

The vulnerability exists in the run_search_api function located in the aim/web/api/runs/views.py file. The core issue stems from improper restriction of user access to the RunView object, which allows for the execution of arbitrary code through the query parameter. The vulnerability has been assigned a CVSS v3.0 base score of 9.8 (CRITICAL) with the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating its severe nature (NVD).

This vulnerability enables attackers to execute arbitrary commands on the server, potentially leading to full system compromise. The critical CVSS score of 9.8 indicates that successful exploitation could result in complete system takeover with no special privileges or user interaction required (NVD).

The vulnerability requires no special privileges or user interaction for exploitation, making it highly exploitable. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N) (NVD).