PT-2026-42861 · Git+2 · Aiograpi

Published 2026-05-23 · Updated 2026-06-11 · CVE-2026-47157

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions aiograpi versions prior to 0.9.10

Description The software accepts server-supplied signup challenge paths and uses them to construct request URLs without first validating that the paths are relative Instagram API paths. If an attacker influences a challenge response—via a local network, DNS, or proxy compromise—challenge handling requests may be sent to an external host while including the client's existing session headers.

Recommendations Update to version 0.9.10.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-47157

GHSA-JH37-X3FV-4X72

Affected Products

Aiograpi

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47157.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-47157 · Security Note
• https://osv.dev/vulnerability/GHSA-jh37-x3fv-4x72 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-47157 · Vendor Advisory
• https://github.com/subzeroid/aiograpi/pull/274 · Note
• https://github.com/subzeroid/aiograpi/releases/tag/0.9.10 · Note
• https://github.com/subzeroid/aiograpi/security/advisories/GHSA-jh37-x3fv-4x72 · Note
• https://github.com/subzeroid/aiograpi/commit/9c24151916beca622e588bfb3167c98711ff744f · Note
• https://github.com/subzeroid/aiograpi · Note
• https://reddit.com/r/VulnMatter/comments/1tna2wo/resumen_diario_de_vulnerabilidades_25052026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1to7zxa/resumen_diario_de_vulnerabilidades_26052026 · Reddit Post