CVE-2023-34457

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a `<input type="file" ...>` inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. Version 1.3.0 contains a patch for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
MechanicalSoup	MechanicalSoup	>= 0.2.0, < 1.3.0
mechanicalsoup_project	mechanicalsoup	>= 0.2.0, < 1.3.0

References

Timeline

Published: Jul 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-344585.3mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, i CVE-2023-344595.9OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to version 4.9.2, when the `verifyMu CVE-2023-34465.3Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_che CVE-2023-344609.8Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope CVE-2023-344615.4PyBB is an open source bulletin board. A manual code review of the PyBB bulletin board server has revealed that a vulnerability could have b CVE-2023-344626.5Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers CVE-2023-344638.1DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions Unau CVE-2023-344645.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.2.1 until ver CVE-2023-344658.1XWiki Platform is a generic wiki platform. Starting in version 11.8-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.2, `Mail.MailConfig` CVE-2023-344664.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 CVE-2023-344677.5XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mai CVE-2023-344688.8The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authori