Remote Code Execution Vulnerability in AIOHTTP Framework by aio-libs
CVE-2026-34993

6.4MEDIUM

Key Information:

Vendor

Aio-libs

Status
Aiohttp
Vendor
CVE Published:
2 June 2026

What is CVE-2026-34993?

The AIOHTTP framework, designed for asynchronous HTTP communication in Python, is vulnerable to a remote code execution issue due to improper handling of untrusted input in the CookieJar.load() method. This flaw allows an attacker to execute arbitrary code if they can manipulate the files being loaded. While most applications utilize this function with trusted user data, those that allow external files to be loaded are at significant risk. The vulnerability has been resolved in AIOHTTP version 3.14.0 and users are encouraged to upgrade to mitigate potential exploitation. For those using older versions, implementing file sanitization measures is recommended before loading any input.

Affected Version(s)

aiohttp < 3.14.0

References

https://github.com/aio-libs/aiohttp/security/advisories/G...
x_refsource_CONFIRM
https://github.com/aio-libs/aiohttp/commit/dcf40f30637e87...
x_refsource_MISC

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.