The Aim library 3.29.1 contains a flaw in its remote tracking server that fails to require authentication before dispatching arbitrary methods via Python's getattr. An attacker who can reach the server can register a client, create repository resources, and invoke any method exposed by the server. The vulnerability can lead to reading experiment data or deleting runs, representing a potential remote code execution attack that compromises confidentiality, integrity, and availability of the tracking data. The weakness is classified as CWE‑306, Improper Authentication.

The flaw affects the Aim software package released by aimhubio, specifically the 3.29.1 version. Version information beyond this release is not provided in the data; users should verify whether they are running 3.29.1 or any unpatched earlier releases.

With a CVSS score of 9.3, the vulnerability is considered critical. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at present. The likely attack vector is network based; an unauthenticated remote actor can exploit the unprotected method dispatch to execute arbitrary actions. Given the absence of authentication, the exploitation conditions are minimal, making this threat highly actionable.