CVE-2024-27306: aiohttp vulnerable to XSS on index pages for static file handling
Modified
AliasesMGASA-2024-0235SUSE-SU-2024:1866-1SUSE-SU-2024:4396-1GHSA-7gpw-8wmc-pm8gPYSEC-2026-1102UBUNTU-CVE-2024-27306DEBIAN-CVE-2024-27306CGA-2468-9f95-mr9hCGA-2rg8-fcwm-2j75CGA-45fm-5r7r-938hCGA-4cpm-jhwx-wf34CGA-5xcx-3r64-jq93CGA-6p5x-mvpc-c6g8CGA-6wjh-g2j4-26jjCGA-7phq-gcjh-m62wCGA-7qvj-m56w-m3fmCGA-9cfw-7hg6-6g2mCGA-9g92-xmgq-r5x5CGA-9j52-8h85-ggj9CGA-c2ph-9v2r-6692CGA-cr6r-mw5g-3838CGA-g4v6-f38r-jwj8CGA-hq96-59rf-46rvCGA-hxx9-q5rm-53vfCGA-m8mj-r63j-2552CGA-p6jg-962q-j4fjCGA-ph4r-4v3h-x92hCGA-q4gj-h366-3m97CGA-qhp7-5jqf-qf6gCGA-qvr6-7rqp-jgxwCGA-r5xx-fq83-f7jcCGA-r9f3-gfrq-p3p2CGA-rf82-w8hr-57vwCGA-wfw5-2p8g-vf39CGA-wh52-gp5f-h9gvCGA-x6rh-hpmv-h436CGA-xv55-r4q4-hfc5openSUSE-SU-2024:13965-1CGA-3gjp-35gr-3v84CGA-92g8-r9mp-5wr3CGA-chpm-6qvh-5pv9CGA-hwvh-v762-hwg4CGA-p55m-84q5-f5pfCGA-qxfq-gfx4-8g32CGA-x2h3-9cqm-h7m3
Published 18-04-2024Last modified 03-11-2025
Vulnerability summary
CVE-2024-27306 is a medium (CVSS 6.1) vulnerability in aio-libs aiohttp. EPSS estimates a 0.67% chance of exploitation in the next 30 days, higher than 51.8% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)EPSS score
0.67%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 8Timeline
- 18-04-2024PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 6.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSourcesAll 7 agree
- OSV · PypiEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.67%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.67% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-80Improper Neutralization of Script-Related HTML Tags in a Web PageThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Affected systems
Version check
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard19 products
- checkov< 3.0.34-r1
- dask-gateway< 2024.1.0-r4
- dask-gateway-server< 2024.1.0-r4
- kserve< 0.13.1-r3
- kserve-agent< 0.13.1-r3
Wolfi15 products
- checkov< 3.0.34-r1
- dask-gateway< 2024.1.0-r4
- dask-gateway-server< 2024.1.0-r4
- kserve< 0.13.1-r3
- kserve-agent< 0.13.1-r3
Suse7 products
- python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP2< 3.6.0-150100.3.24.1
- python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP3< 3.6.0-150100.3.24.1
- python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4< 3.9.3-150400.10.21.1 | < 3.6.0-150100.3.24.1
- python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP5< 3.6.0-150100.3.24.1
- python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP6< 3.6.0-150100.3.24.1
Opensuse3 products
- python-aiohttp&distro=openSUSE Leap 15.5< 3.9.3-150400.10.21.1 | < 3.6.0-150100.3.24.1
- python-aiohttp&distro=openSUSE Leap 15.6< 3.9.3-150400.10.21.1
- python-aiohttp&distro=openSUSE Tumbleweed< 3.9.5-2.1
Aio-libs1 product
- aiohttp< 3.9.4
Aiohttp1 product
- aiohttp< 3.9.4
Debian1 product
- python-aiohttpAll versions (No fix recorded) | < 3.9.5-1
Fedoraproject1 product
- fedoraEOL38 | 39 | 40
Mageia1 product
- python-aiohttp< 3.8.3-3.1.mga9
PyPI1 product
- aiohttp< 3.9.4
Ubuntu1 product
- python-aiohttp< 3.0.1-1ubuntu0.1~esm5 | < 3.8.1-4ubuntu0.2+esm1 | < 3.9.1-1ubuntu0.1+esm1
11 vendors · 51 products
References
26 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8gX Refsource CONFIRMWEBREPORTAdvisoryVendor Advisory
- github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397X Refsource MISCWEBREPORTFIXPatch
Show all 26 references
- github.com/aio-libs/aiohttpPACKAGE
- pypi.org/project/aiohttpPACKAGE