GHSA-7mw3-79jq-xc7f: Aiograpi Aiograpi Has Dependency On Vulnerable Vulnerability

LOW
Share
CWE-770
Published
Advisory Summary

GHSA-7mw3-79jq-xc7f is a LOW aiograpi has dependency on vulnerable vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) affecting Aiograpi libraries in the PyPI ecosystem. The issue involves aiograpi has dependency on vulnerable orjson 3.11.4 (cve-2025-67221). Remediation is available by upgrading affected packages to version 0.7.2.

GHSA-7mw3-79jq-xc7f at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-7mw3-79jq-xc7f
Severity LOW
CVSS v3.1 Base Score N/A
CWE Classification CWE-770: Allocation of Resources Without Limits or Throttling
Affected Product Aiograpi
Package Ecosystem PyPI
Published Date
Last Updated

How to Fix GHSA-7mw3-79jq-xc7f

To remediate this vulnerability, upgrade all affected Aiograpi dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

aiograpi fixed: 0.7.2 
pip install aiograpi>=0.7.2
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show aiograpi

How to Check if You Are Affected

To determine whether your Python environment is affected by GHSA-7mw3-79jq-xc7f, inspect your installed packages using pip:

pip show aiograpi

Analyze the terminal output to locate any version of Aiograpi in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.7.2), your application is affected.

Note: The pip show aiograpi command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling, where the product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. In Aiograpi, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Impact aiograpi 0.6.6 / 0.7.0 / 0.7.1 declared `orjson==3.11.6` (and later `==3.11.8`) in `requirements.txt` but `setup.py` carried a hard-coded duplicate `requirements = [...]` list that was never updated and still pinned `orjson==3.11.4`. When `setuptools` builds the source distribution it reads the metadata from `setup.py`, not from `requirements.txt`. So `pip install aiograpi==0.6.6` (or 0.7.0 / 0.7.1) actually pulls `orjson==3.11.4` — a version vulnerable to **CVE-2025-67221** (stack overflow in `orjson.dumps` on deeply nested JSON inputs). ## Practical exploitability Low in the typical aiograpi flow: `orjson` is used to encode request bodies aiograpi itself constructs and to decode responses returned by Instagram. An attacker would need to coerce aiograpi to encode an attacker-controlled deeply-nested Python structure or to decode an attacker-supplied stream — not the normal call shape. However any caller doing `client.public_request(...)` or similar with caller-controlled payloads, or any caller passing aiograpi-decoded `last_json` into recursive serialization, may hit the unbounded recursion. The patched orjson rejects deeply-nested inputs cleanly. ## Patches Fixed in **aiograpi 0.7.2** by migrating to `pyproject.toml` (PEP 621) — single source of truth for dependencies. PyPI installs of 0.7.2 and later resolve `orjson==3.11.8` correctly. ## Workarounds Force-install a non-vulnerable orjson alongside the affected aiograpi version: ``` pip install 'aiograpi==0.7.1' 'orjson>=3.11.6' ``` Or just upgrade to a fixed aiograpi: ``` pip install -U 'aiograpi>=0.7.2' ``` ## Resources - orjson CVE-2025-67221 advisory: https://github.com/ijl/orjson/security/advisories - aiograpi 0.7.2 changelog (security section): https://github.com/subzeroid/aiograpi/blob/main/CHANGELOG.md#072--2026-04-27

GHSA-7mw3-79jq-xc7f Affected Aiograpi Versions

1 component(s)
Fixed Versions:
0.7.2
Product / Package Ecosystem Affected Versions Fixed Version
aiograpi
pypi/aiograpi
PyPI
≥ 0.6.6
< 0.7.2
0.7.2

References

GitHub Advisory / Wiki ADVISORY
https://github.com/subzeroid/aiograpi/security/advisories/GHSA-7mw3-79jq-xc7f
Aiograpi Source Repository REPOSITORY
https://github.com/ijl/orjson/security/advisories
Aiograpi Source Repository REPOSITORY
https://github.com/subzeroid/aiograpi
Aiograpi Source Repository REPOSITORY
https://github.com/subzeroid/aiograpi/blob/main/CHANGELOG.md#072--2026-04-27

Frequently Asked Questions

What is GHSA-7mw3-79jq-xc7f?
GHSA-7mw3-79jq-xc7f is a security vulnerability in Aiograpi involving aiograpi has dependency on vulnerable orjson 3.11.4 (CVE-2025-67221) under CWE-770: Allocation of Resources Without Limits or Throttling.
Which Aiograpi versions are affected?
Affected versions include releases prior to 0.7.2 across affected packages: aiograpi.
What version fixes GHSA-7mw3-79jq-xc7f?
Upgrading to 0.7.2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is aiograpi affected?
Yes, aiograpi is affected in releases prior to 0.7.2. Upgrade your dependency to 0.7.2 or later.
What CWE is associated with GHSA-7mw3-79jq-xc7f?
GHSA-7mw3-79jq-xc7f is classified under CWE-770: Allocation of Resources Without Limits or Throttling (The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.).
How can I check PyPI dependencies for GHSA-7mw3-79jq-xc7f?
Run the dependency tree command: 'pip show aiograpi'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7mw3-79jq-xc7f",
  "modified" : "2026-05-06T22:06:11Z",
  "published" : "2026-05-06T22:06:11Z",
  "aliases" : [ ],
  "summary" : "aiograpi has dependency on vulnerable orjson 3.11.4 (CVE-2025-67221)",
  "details" : "## Impact\n\naiograpi 0.6.6 / 0.7.0 / 0.7.1 declared `orjson==3.11.6` (and later `==3.11.8`) in `requirements.txt` but `setup.py` carried a hard-coded duplicate `requirements = [...]` list that was never updated and still pinned `orjson==3.11.4`.\n\nWhen `setuptools` builds the source distribution it reads the metadata from `setup.py`, not from `requirements.txt`. So `pip install aiograpi==0.6.6` (or 0.7.0 / 0.7.1) actually pulls `orjson==3.11.4` — a version vulnerable to **CVE-2025-67221** (stack overflow in `orjson.dumps` on deeply nested JSON inputs).\n\n## Practical exploitability\n\nLow in the typical aiograpi flow: `orjson` is used to encode request bodies aiograpi itself constructs and to decode responses returned by Instagram. An attacker would need to coerce aiograpi to encode an attacker-controlled deeply-nested Python structure or to decode an attacker-supplied stream — not the normal call shape.\n\nHowever any caller doing `client.public_request(...)` or similar with caller-controlled payloads, or any caller passing aiograpi-decoded `last_json` into recursive serialization, may hit the unbounded recursion. The patched orjson rejects deeply-nested inputs cleanly.\n\n## Patches\n\nFixed in **aiograpi 0.7.2** by migrating to `pyproject.toml` (PEP 621) — single source of truth for dependencies. PyPI installs of 0.7.2 and later resolve `orjson==3.11.8` correctly.\n\n## Workarounds\n\nForce-install a non-vulnerable orjson alongside the affected aiograpi version:\n\n```\npip install 'aiograpi==0.7.1' 'orjson>=3.11.6'\n```\n\nOr just upgrade to a fixed aiograpi:\n\n```\npip install -U 'aiograpi>=0.7.2'\n```\n\n## Resources\n\n- orjson CVE-2025-67221 advisory: https://github.com/ijl/orjson/security/advisories\n- aiograpi 0.7.2 changelog (security section): https://github.com/subzeroid/aiograpi/blob/main/CHANGELOG.md#072--2026-04-27",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "aiograpi"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.6.6"
      }, {
        "fixed" : "0.7.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/subzeroid/aiograpi/security/advisories/GHSA-7mw3-79jq-xc7f"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ijl/orjson/security/advisories"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/subzeroid/aiograpi"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/subzeroid/aiograpi/blob/main/CHANGELOG.md#072--2026-04-27"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-770" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-06T22:06:11Z",
    "nvd_published_at" : null
  }
}