CVE-2026-34993: aio-libs aiohttp code execution via deserialization in CookieJar.load

Executive brief

AIOHTTP is a popular Python library used for building web servers and clients. A security flaw in how it handles saved cookie files could allow an attacker to execute malicious code on a system if they can trick the application into loading a specially crafted file. While this requires significant access to the system, it could lead to a full compromise of the application and its data.

Technical details

A deserialization vulnerability (CWE-502) exists in the `CookieJar.load()` function of the aiohttp library. The root cause is the unsafe processing of untrusted data during the loading of cookie files, which can be leveraged to achieve arbitrary code execution. Exploitation requires a local attacker with high privileges to provide a malicious file and requires user interaction (triggering the load). The vulnerability is patched in version 3.14.0.

Affected products

• aio-libs aiohttp < 3.14.0

Timeline

• 2026-06-02: disclosed
• 2026-06-03: advisory
• 2026-06-03: patched

References

• https://api.github.com/users/tsigouris007
• https://github.com/tsigouris007
• https://api.github.com/users/tsigouris007/gists%7B/gist_id%7D
• https://api.github.com/users/tsigouris007/repos
• https://avatars.githubusercontent.com/u/10864434?v=4
• https://api.github.com/users/tsigouris007/events%7B/privacy%7D