aiograpi: Unsafe signup challenge path handling

aiograpi versions before 0.9.10 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. A malicious or tampered challenge payload could cause challenge handling requests to be sent outside the intended...

aiograpi-rest (>=1.0.0, <=5.15.2) potentially affected by CVE-2026-47157 via aiograpi (0.9.7)

aiograpi PYPI version 0.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiograpi and may be impacted: - aiograpi-rest =1.0.0, =5.15.2 Source cves: CVE-2026-47157 Source advisory: OSV:PYSEC-2026-2337...

CVE-2026-47157

aiograpi is an asynchronous Instagram API for Python. aiograpi versions before 0.9.10 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. If an attacker can influence a challenge response, for...

aiograpi-rest (>=1.0.0, <=5.15.2) potentially affected by CVE-2026-47157 via aiograpi (0.9.7)

aiograpi PYPI version 0.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiograpi and may be impacted: - aiograpi-rest =1.0.0, =5.15.2 Source cves: CVE-2026-47157 Source advisory: MEND:CVE-2026-47157...

CVE-2026-47157

aiograpi (Python) before 0.9.10 accepted server-supplied signup challenge paths and built request URLs before validating that the paths were relative Instagram API paths. An attacker who can influence a challenge response (e.g., on a local network, via DNS, or via a proxy) could cause challenge h...

CVE-2026-47157

aiograpi is an asynchronous Instagram API for Python. aiograpi versions before 0.9.10 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. If an attacker can influence a challenge response, for...

EUVD-2026-36272

aiograpi is an asynchronous Instagram API for Python. aiograpi versions before 0.9.10 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. If an attacker can influence a challenge response, for...

CVE-2026-47157 aiograpi: Unsafe signup challenge path handling

aiograpi is an asynchronous Instagram API for Python. aiograpi versions before 0.9.10 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. If an attacker can influence a challenge response, for...

CVE-2026-47157 aiograpi: Unsafe signup challenge path handling

aiograpi is an asynchronous Instagram API for Python. aiograpi versions before 0.9.10 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. If an attacker can influence a challenge response, for...

AIOGRAPI code issues and vulnerabilities

aiograpi is an asynchronous Instagram API Python library developed by Mark. Versions of aiograpi prior to 0.9.10 contained code vulnerabilities. These vulnerabilities stemmed from accepting registration challenge paths provided by the server and using them to construct the request URL before...

GHSA-JH37-X3FV-4X72 aiograpi: Unsafe signup challenge path handling

aiograpi versions before 0.9.10 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. A malicious or tampered challenge payload could cause challenge handling requests to be sent outside the intended...

Server-side Request Forgery (SSRF)

Overview aiograpi is an Asynchronous Instagram Private API wrapper Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the signup challenge path handling process. An attacker can access sensitive information by supplying a malicious challenge payload that caus...

aiograpi-rest (>=1.0.0, <=5.15.2) potentially affected by CVE-2026-47157 via aiograpi (0.9.7)

aiograpi PYPI version 0.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiograpi and may be impacted: - aiograpi-rest =1.0.0, =5.15.2 Source cves: CVE-2026-47157 Source advisory: SNYK:PYTHON-AIOGRAPI-17670586...

aiograpi-rest (>=1.0.0, <=5.15.2) potentially affected by CVE-2026-47157 via aiograpi (0.9.7)

aiograpi PYPI version 0.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiograpi and may be impacted: - aiograpi-rest =1.0.0, =5.15.2 Source cves: CVE-2026-47157 Source advisory: GHSA-JH37-X3FV-4X72...

aiograpi-rest (>=1.0.0, <=5.15.2) potentially affected by CVE-2026-47157 via aiograpi (0.9.7)

aiograpi PYPI version 0.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiograpi and may be impacted: - aiograpi-rest =1.0.0, =5.15.2 Source cves: CVE-2026-47157 Source advisory: OSV:GHSA-JH37-X3FV-4X72...

GHSA-7MW3-79JQ-XC7F aiograpi has dependency on vulnerable orjson 3.11.4 (CVE-2025-67221)

Impact aiograpi 0.6.6 / 0.7.0 / 0.7.1 declared orjson==3.11.6 and later ==3.11.8 in requirements.txt but setup.py carried a hard-coded duplicate requirements = ... list that was never updated and still pinned orjson==3.11.4. When setuptools builds the source distribution it reads the metadata fro...

aiograpi has dependency on vulnerable orjson 3.11.4 (CVE-2025-67221)

Impact aiograpi 0.6.6 / 0.7.0 / 0.7.1 declared orjson==3.11.6 and later ==3.11.8 in requirements.txt but setup.py carried a hard-coded duplicate requirements = ... list that was never updated and still pinned orjson==3.11.4. When setuptools builds the source distribution it reads the metadata fro...