CVE-2024-27306 — Cross-site Scripting in Aiohttp

CWE-79 — Cross-site ScriptingCWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)8 documents7 sources
Severity
6.1MEDIUMNVD
EPSS
0.7%
top 26.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Aio-libs AiohttpAiohttpFedoraproject Fedora
Timeline
PublishedApr 18
Latest updateJul 17

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶NVDaiohttp/aiohttp< 3.9.4
▶PyPIaiohttp/aiohttp< 3.9.4
▶CVEListV5aio-libs/aiohttp< 3.9.4

Also affects: Fedora 38, 39, 40

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
aiohttp Cross-site Scripting vulnerability on index pages for static file handling↗2024-04-18
▶
OSV
CVE-2024-27306: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python↗2024-04-18
▶
CVEList
aiohttp vulnerable to XSS on index pages for static file handling↗2024-04-18
▶
OSV
aiohttp Cross-site Scripting vulnerability on index pages for static file handling↗2024-04-18
▶

📋Vendor Advisories

3
Ubuntu
AIOHTTP vulnerabilities↗2025-07-17
▶
Red Hat
aiohttp: XSS on index pages for static file handling↗2024-04-18
▶
Debian
CVE-2024-27306: python-aiohttp - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. ...↗2024
▶
CVE-2024-27306 — Cross-site Scripting in Aiohttp | cvebase