cleveragents/cleveragents-core
4
0
Fork 3
Code Issues 6.0k Pull Requests 115 Actions Packages Projects Releases Wiki Activity

fix(deps): upgrade aiohttp to 3.13.4 to remediate CVE-2026-34513 open redirect #1642

Closed
freemo wants to merge 1 commits from fix/dependency-security-aiohttp-cve-2026-34513 into master
pull from: fix/dependency-security-aiohttp-cve-2026-34513
merge into: cleveragents:master
Conversation 6 Commits 1 Files Changed 1
+1

1 Commits

Author SHA1 Message Date
freemo 7ba8f6ac23 fix(deps): upgrade aiohttp to 3.13.4 to remediate CVE-2026-34513 open redirect
CI / benchmark-publish (pull_request) Has been skipped
Details
CI / lint (pull_request) Failing after 16s
Details
CI / build (pull_request) Successful in 19s
Details
CI / helm (pull_request) Successful in 25s
Details
CI / typecheck (pull_request) Failing after 50s
Details
CI / coverage (pull_request) Has been skipped
Details
CI / benchmark-regression (pull_request) Has been skipped
Details
CI / security (pull_request) Failing after 52s
Details
CI / unit_tests (pull_request) Failing after 1m45s
Details
CI / docker (pull_request) Has been skipped
Details
CI / quality (pull_request) Successful in 3m41s
Details
CI / e2e_tests (pull_request) Failing after 14m11s
Details
CI / integration_tests (pull_request) Failing after 20m49s
Details
CI / status-check (pull_request) Failing after 1s
Details 
Add explicit aiohttp>=3.13.4 dependency to pyproject.toml to remediate
CVE-2026-34513, a high-severity open redirect vulnerability in aiohttp.

An attacker could craft a malicious URL that, when processed by the
application, redirects users to an arbitrary external site. This can be
exploited for phishing attacks or to bypass security controls.

The CleverAgents platform uses aiohttp as part of its async HTTP
infrastructure (A2A server, tool source fetching, and agent communication
layers). Adding an explicit minimum version constraint ensures the
vulnerable version (3.13.3) cannot be installed even as a transitive
dependency.

ISSUES CLOSED: #1549
 2026-04-02 23:20:03 +00:00