{"action":"Upgrade aiohttp to 3.9.4 or later.","affected":[{"fixed":"3.9.4","introduced":"0"}],"component":"aiohttp","cve_ids":["CVE-2024-27306"],"ecosystem":"PyPI","epss":0.00666,"exploited":false,"fixed_versions":["3.9.4"],"ghsa_id":"GHSA-7gpw-8wmc-pm8g","id":"tcs_01M5KGQK6VHFS5KFXFQ07FMRKB","modified_at":"2026-07-07T17:46:25.711160585Z","published_at":"2026-07-07T11:45:39.766336Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1102","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8g","https://nvd.nist.gov/vuln/detail/CVE-2024-27306","https://github.com/aio-libs/aiohttp/pull/8319","https://github.com/aio-libs/aiohttp/pull/8319/files","https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397","https://github.com/aio-libs/aiohttp","https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EXRGTN2WG7VZLUZ7WOXU5GQJKCPPHKP","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWEI6NIHZ3G7DURDZVMRK7ZEFC2BTD3U","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIVBMPEY7WWOFMC3CWXFBRQPFECV4SW3","https://pypi.org/project/aiohttp","https://github.com/advisories/GHSA-7gpw-8wmc-pm8g"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-1102","url":"https://osv.dev/vulnerability/PYSEC-2026-1102"}],"summary":"aiohttp Cross-site Scripting vulnerability on index pages for static file handling"}