The Aim platform contains a critical Cross-site Scripting vulnerability that permits unauthorized JavaScript execution, posing a significant risk to user session integrity and data security.

This vulnerability occurs because the application fails to sanitize or restrict JavaScript execution when processing malicious Python code via the /api/reports endpoint, which is subsequently interpreted by Pyodide. The attack vector is unauthenticated and requires user interaction to execute the malicious script in the victim's browser.

Successful exploitation of this XSS vulnerability can lead to full account takeover, unauthorized access to sensitive telemetry data stored within the Aim platform, and potential propagation of malicious code to other users. With a CVSS score of 8.8, this flaw represents a high risk to organizational security, as it allows attackers to bypass standard web protections and compromise the confidentiality and integrity of the application environment.

Immediate Action: As no official patch is currently listed, users should restrict access to the /api/reports endpoint and monitor for suspicious report submissions.

Proactive Monitoring: Security teams should monitor web server logs for irregular API activity or unusual patterns in report creation and viewing requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to identify and block malicious payloads directed at the /api/reports API endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the research write-up provided by Gecko Security.

Given the high CVSS severity and the availability of a public proof-of-concept, organizations should treat this vulnerability with high priority. We recommend disabling the reporting functionality or implementing strict input validation and access controls until a vendor-supplied patch is made available.