GHSA-jg22-mg44-37j8
AIOHTTP is Vulnerable to Deserialization of Untrusted Data
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-34993
- Alias
- PYSEC-2026-2104
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L
Description
### Summary Using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. ### Impact Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. ### Workaround If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitise the files before loading. ----- Patch: https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · aiohttp | introduced 0, fixed 3.14.0 |
Références
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-34993 ADVISORY
- https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00 WEB
- https://github.com/aio-libs/aiohttp PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |