{"action":"Upgrade aim to 3.1.0 or later.","affected":[{"fixed":"3.1.0","introduced":"0"}],"component":"aim","cve_ids":["CVE-2021-43775"],"ecosystem":"PyPI","epss":0.01907,"exploited":false,"fixed_versions":["3.1.0"],"ghsa_id":"GHSA-8phj-f9w2-cjcc","id":"tcs_01M5KGFJ3S90FF2GDVYA8KW6XK","modified_at":"2023-11-08T04:07:11.569815Z","published_at":"2021-11-23T21:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-839","https://github.com/aimhubio/aim/issues/999","https://github.com/aimhubio/aim/security/advisories/GHSA-8phj-f9w2-cjcc","https://github.com/aimhubio/aim/pull/1003","https://github.com/aimhubio/aim/blob/0b99c6ca08e0ba7e7011453a2f68033e9b1d1bce/aim/web/api/views.py#L9-L16","https://github.com/aimhubio/aim/pull/1003/commits/f01266a1a479ef11d7d6c539e7dd89e9d5639738"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-839","url":"https://osv.dev/vulnerability/PYSEC-2021-839"}],"summary":"Aim is an open-source, self-hosted machine learning experiment tracking tool. Versions of Aim prior to 3.1.0 are vulnerable to a path traversal attack. By manipulating variables that reference files w"}