CVE-2026-47157 Details
Description
aiograpi is an asynchronous Instagram API for Python. aiograpi versions before 0.9.10 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. If an attacker can influence a challenge response, for example through a local network, DNS, or proxy compromise, challenge handling requests could be sent outside the intended Instagram host with the client's existing session headers. Version 0.9.10 validates challenge paths before building URLs, solving captcha challenges, or submitting phone/SMS challenge forms.
A vulnerability exists in aiograpi, an asynchronous Instagram API client for Python, in versions prior to 0.9.10. The issue arises because the library accepted server-supplied signup challenge paths without proper validation, allowing attackers to manipulate these paths. This could lead to requests being sent to unintended hosts outside of Instagram, using the client's session headers. The vulnerability could be exploited through local network, DNS, or proxy compromises.
Users can upgrade to aiograpi version 0.9.10 or later, which includes the necessary validation for challenge paths before they are used in API requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 11, 2026CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/subzeroid/aiograpi/commit/9c24151916beca622e588bfb3167c98711ff744f | [email protected] | Source CodeVendor |
| https://github.com/subzeroid/aiograpi/pull/274 | [email protected] | Issue TrackingVendor |
| https://github.com/subzeroid/aiograpi/releases/tag/0.9.10 | [email protected] | Release NotesVendor |
| https://github.com/subzeroid/aiograpi/security/advisories/GHSA-jh37-x3fv-4x72 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| subzeroid aiograpi | < 0.9.10 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | New CVE Received | [email protected] |