goblin (1.0.0b1) potentially affected by CVE-2025-69226 via aiohttp (0.22.1)

aiohttp PYPI version 0.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - goblin 1.0.0b1 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

okami (0.1.5) potentially affected by CVE-2025-69226 via aiohttp (2.0.3)

aiohttp PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - okami 0.1.5 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

aiodocker (0.7.0), aiopogo (>=1.6.0b1, <=2.0.0) +10 more potentially affected by CVE-2025-69226 via aiohttp (2.0.7)

aiohttp PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiodocker 0.7.0 - aiopogo =1.6.0b1, =0.1.0, =0.1.0, =0.42.4, =0.0.1, =0.9.6, =1.1.0, =1.3.3 Source cves: CVE-2025-69226 Source advisory:...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure over the /static endpoint. An attacker can determine the existence of internal path components by sending requests to probe for absolute path elements. Remediation Upgrade aiohttp to version 3.13.3 or higher...

muffin (0.7.0), solo (0.0.1) potentially affected by CVE-2025-69226 via aiohttp (0.21.5)

aiohttp PYPI version 0.21.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.7.0 - solo 0.0.1 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

0x20bf (0.0.1), 2keys (0.5.1) +3141 more potentially affected by CVE-2025-69226 via aiohttp (>=3.0.0b0, <=3.13.2)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.0, =0.1.0b0, =1.0.99 and more Source cves: CVE-2025-69226 Source advisory: SNYK:PYTHON-AIOHTTP-14871888...

muffin (>=0.0.46, <=0.0.52) potentially affected by CVE-2025-69226 via aiohttp (0.15.0)

aiohttp PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.46, =0.0.52 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

aiogremlin (>=3.2.4b1, <=3.2.5), goblin (2.0.0b1) +3 more potentially affected by CVE-2025-69226 via aiohttp (1.3.3)

aiohttp PYPI version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin =3.2.4b1, =0.39.0, =1.0.0b1, =1.0.0b2 - okami 0.1.4 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

homeassistant (>=0.58.0, <=0.58.1), pyplanet (>=0.5.0, <=0.5.2) +1 more potentially affected by CVE-2025-69226 via aiohttp (2.3.2)

aiohttp PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.58.0, =0.5.0, =0.6.0, =0.6.2 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

homeassistant (0.42.1) potentially affected by CVE-2025-69226 via aiohttp (2.0.6)

aiohttp PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant 0.42.1 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

interest (0.0.1) potentially affected by CVE-2025-69226 via aiohttp (0.14.0)

aiohttp PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - interest 0.0.1 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

GHSA-54JQ-C3M8-4M76 AIOHTTP vulnerable to brute-force leak of internal static file path components

Summary Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components. Impact If an application uses web.static not recommended for production deployments, it may be possible for an attacker to ascertai...

muffin (0.5.0) potentially affected by CVE-2025-69226 via aiohttp (0.20.0)

aiohttp PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.0 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

botstory (>=0.0.33, <=0.0.37) potentially affected by CVE-2025-69226 via aiohttp (1.1.1)

aiohttp PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.33, =0.0.37 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

aio-tinder (>=0.1.7, <=0.1.8) potentially affected by CVE-2025-69226 via aiohttp (1.0.1)

aiohttp PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.7, =0.1.8 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

aioboto3 (>=1.1.0, <=2.1.0), aiobotocore (>=0.4.2, <=0.4.5) +2 more potentially affected by CVE-2025-69226 via aiohttp (2.3.0)

aiohttp PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 =1.1.0, =0.4.2, =0.4.1b31, =0.6.0b19, =0.6.0b23 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

aiobotocore (>=0.4.0, <=0.4.1), async-patterns (0.2.0) +7 more potentially affected by CVE-2025-69226 via aiohttp (2.2.0)

aiohttp PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiobotocore =0.4.0, =0.1.1, =0.2.2, =0.48.0, =0.4.1b2, =0.5.2b0, =0.1.0a88, =0.1.0b10 Source cves: CVE-2025-69226 Source advisory:...

muffin (>=0.0.23, <=0.0.45) potentially affected by CVE-2025-69226 via aiohttp (0.14.4)

aiohttp PYPI version 0.14.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.23, =0.0.45 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

muffin (>=0.0.2, <=0.0.22) potentially affected by CVE-2025-69226 via aiohttp (0.14.1)

aiohttp PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.2, =0.0.22 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

muffin (>=0.0.98, <=0.0.104) potentially affected by CVE-2025-69226 via aiohttp (0.16.6)

aiohttp PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.98, =0.0.104 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...