Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user-s own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.
CVSS 6.4EPSS 0.179%Risk 0.65
View source- Published
- 2026-06-02 20:16:34
- Affected versions
- <3.14.0
- Type
- Package
- Last modified
- 2026-08-11 13:18:33
- Vector
- CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L