GitHub Advisoryadvisory · PyPI

GHSA-jg22-mg44-37j8 AIOHTTP is Vulnerable to Deserialization of Untrusted Data

MEDIUM Published 2026-06-03 Modified 2026-06-03 Official page ↗
Aliases
CVE-2026-34993
Ecosystem
PyPI
Packages
aiohttp
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L
Weaknesses
CWE-502
Reviewed
2026-06-03

Affected packages

• PyPI aiohttp: < 3.14.0 → fixed in 3.14.0

Description

Summary Using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Impact Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Workaround If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitise the files before loading. ----- Patch: https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00

Related

Alias · CVE (1)

  • CVE-2026-34993 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References