Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

mechanicalsoup

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7PyPIAmendedPublished

    MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML form

    CVE-2023-34457 · GHSA-x456-3ccm-m6j4

    Affected
    • PyPI mechanicalsoup >= 0.2.0, < 1.3.0
    Fixed in
    1.3.0· Vendor fix available
    Issue
    A malicious web server can read arbitrary files on the client using a <input type="file" ... inside HTML form. Details This affects the extremely common pattern of form submission: The problem is with the code in browser.Browser.getrequestkwargs: The file path is taken from the bs4 tag "value" attribute. However, this path will default to whatever the server sends. So if a malicious web server were to send something like: then upon .submitselected() the mechanicalsoup browser will happily send over the contents of your SSH private key. PoC Suggested patch Impact All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values.

    Recommended action: Upgrade to 1.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →