CVE-2026-34993: 
Wolfi vulnerability analysis and mitigation

CVE-2026-34993 is a Deserialization of Untrusted Data vulnerability in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. The flaw exists in the CookieJar.load() function, which previously used Python's pickle module without restriction, allowing arbitrary code execution when loading attacker-controlled cookie jar files. All versions of aiohttp prior to 3.14.0 are affected. The vulnerability was published on June 2, 2026, with a patch released the same day. It carries a CVSS v3.1 base score of 6.4 (Moderate) per the official GitHub Security Advisory (GitHub Advisory, aiohttp Advisory).

The root cause is classified as CWE-502 (Deserialization of Untrusted Data). Prior to version 3.14.0, CookieJar.load() used Python's pickle.load() directly on the provided file without any class restrictions, meaning a maliciously crafted pickle payload could instantiate arbitrary Python objects and execute system commands upon deserialization. Exploitation requires that an attacker can supply or influence the cookie jar file loaded by the application — a local attack vector requiring high privileges and user interaction. The fix (commit dcf40f3) replaces the save() method with JSON serialization and introduces a _RestrictedCookieUnpickler class for legacy pickle files that whitelists only cookie-related types (SimpleCookie, Morsel, defaultdict, and basic builtins), preventing arbitrary class instantiation (aiohttp Commit, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the Python process running the aiohttp application, potentially leading to full confidentiality, integrity, and availability compromise of the affected system. The scope is marked as "Changed" in the official advisory's CVSS vector, indicating potential impact beyond the vulnerable component itself. However, the practical impact is limited by the requirement that the attacker must be able to supply a malicious cookie jar file to the application, which is an uncommon scenario for most deployments (aiohttp Advisory).

1. Identify a vulnerable target: Locate an application using aiohttp < 3.14.0 that calls CookieJar.load() with a file path that can be influenced by an attacker (e.g., a user-configurable cookie file path or a shared file system location).
2. Craft a malicious pickle payload: Create a Python pickle file containing a malicious object that executes arbitrary commands upon deserialization. For example, use Python's pickle module to serialize an object whose __reduce__ method returns (os.system, ('id',)) or a reverse shell command.
3. Place the malicious file: Write or substitute the crafted pickle file at the path that the target application will pass to CookieJar.load(). This may require local file system access or the ability to influence the application's file input.
4. Trigger deserialization: Cause the application to call CookieJar.load() on the malicious file — for example, by restarting the application, triggering a session restore, or invoking the relevant application functionality.
5. Achieve code execution: The unpatched pickle.load() call deserializes the payload, executing the embedded command with the privileges of the Python process (aiohttp Advisory, aiohttp Commit).

• File System: Unexpected or modified cookie jar files (.pkl, .pickle, or application-specific cookie storage files) in application data directories; files with pickle magic bytes (\x80\x04) in locations expected to contain JSON or text cookie data.
• Process: Unusual child processes spawned by the Python/aiohttp process (e.g., sh, bash, cmd.exe, curl, wget, python) that are not part of normal application behavior.
• Logs: Application error logs showing pickle.UnpicklingError or unexpected exceptions during CookieJar.load() calls (may indicate probing or failed exploit attempts on patched systems); absence of expected log entries if the process is silently hijacked.
• Network: Unexpected outbound connections from the aiohttp process to external IPs, particularly on non-standard ports, following a CookieJar.load() operation.

Upgrade aiohttp to version 3.14.0 or later, which replaces pickle-based serialization in CookieJar.save() with JSON and introduces a restricted unpickler for legacy file compatibility (GitHub Advisory, aiohttp Commit). For applications that cannot immediately upgrade, sanitize and validate cookie jar files before passing them to CookieJar.load(), and restrict which users or processes can supply files to the application. Additionally, ensure that cookie jar file paths are not user-controllable and that file system permissions prevent unauthorized modification of cookie storage files.