CVE-2024-27306

Aliases:GHSA-7gpw-8wmc-pm8g
Advisory lineage Upstream: 0 Downstream: 11
Modified
Published: 18 Apr 2024, 14:23
Last modified:03 Nov 2025, 20:37

Vulnerability Summary

Overall Risk (default)
medium
25/100
CVSS Score
6.1 MEDIUM
v3.1 (cve.org)
EPSS Score
0.71% LOW
1% probability -0.04%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

18 Apr 2024, 14:23
Published
Vulnerability first disclosed
03 Nov 2025, 20:37
Last Modified
Vulnerability information updated

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.71%• Percentile: 73%

Techniques & Countermeasures

  • CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

  • CWE-80•Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

    The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Affected Systems

  • aio-libs•aiohttp

    < 3.9.4

  • aiohttp•aiohttp

    < 3.9.4

  • fedoraproject•fedora

    38 | 39 | 40

  • PyPI•aiohttp

    < 3.9.4

References (13)