~ / search / GHSA-jg22-mg44-37j8

GHSA-jg22-mg44-37j8

AIOHTTP is Vulnerable to Deserialization of Untrusted Data

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-34993

Packages

EcosystemPackageAffectedFixed in
PyPI aiohttp < 3.14.0 3.14.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary Using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. ### Impact Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. ### Workaround If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitise the files before loading. ----- Patch: https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00

References

External links from the advisory. They lead to third-party sites.