AIOHTTP, an asynchronous HTTP client/server framework for Python, contains a flaw in the CookieJar.load() function that may deserialize untrusted data. In versions prior to 3.14.0, this deserialization can execute arbitrary code, falling under CWE‑502. When a malicious file is loaded, the attacker can run code in the context of the application, potentially compromising confidentiality, integrity and availability of the affected service.

The vulnerability affects the aio-libs aiohttp package for all releases before 3.14.0. Applications that invoke CookieJar.load() with data that could be supplied by a user, such as uploaded files or user‑controlled configuration, are at risk. In many deployments, CookieJar.load() is only used with the application's own data, which reduces exposure, but if the application accepts external inputs it becomes exploitable.

The CVSS score of 6.4 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that an attacker who can provide a crafted file to CookieJar.load() can trigger arbitrary code execution; if the application accepts remote uploads, the vector becomes remote. Consequently, the risk remains significant for affected deployments, especially those that process user‑supplied files.