{"action":"Upgrade aiohttp to 3.9.4 or later.","affected":[{"fixed":"3.9.4","introduced":"0"}],"component":"aiohttp","cve_ids":["CVE-2024-27306"],"ecosystem":"PyPI","epss":0.00666,"exploited":false,"fixed_versions":["3.9.4"],"ghsa_id":"GHSA-7gpw-8wmc-pm8g","id":"tcs_01M5KF5YV6W5KPZ8FS2DX2FD1G","modified_at":"2026-09-10T03:50:11.218890208Z","published_at":"2024-04-18T13:45:21Z","references":["https://osv.dev/vulnerability/GHSA-7gpw-8wmc-pm8g","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8g","https://nvd.nist.gov/vuln/detail/CVE-2024-27306","https://github.com/aio-libs/aiohttp/pull/8319","https://github.com/aio-libs/aiohttp/pull/8319/files","https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397","https://github.com/aio-libs/aiohttp","https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EXRGTN2WG7VZLUZ7WOXU5GQJKCPPHKP","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWEI6NIHZ3G7DURDZVMRK7ZEFC2BTD3U","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIVBMPEY7WWOFMC3CWXFBRQPFECV4SW3"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-7gpw-8wmc-pm8g","url":"https://osv.dev/vulnerability/GHSA-7gpw-8wmc-pm8g"}],"summary":"aiohttp Cross-site Scripting vulnerability on index pages for static file handling"}