CVE-2023-34457

MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a `<input type="file" ...>` inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. Version 1.3.0 contains a patch for this issue.

• CWE-20
• CWE-20

• https://github.com/MechanicalSoup/MechanicalSoup/commit/d57c4a269bba3b9a0c5bfa20292955b849006d9ePatch
• https://github.com/MechanicalSoup/MechanicalSoup/releases/tag/v1.3.0Release Notes
• https://github.com/MechanicalSoup/MechanicalSoup/security/advisories/GHSA-x456-3ccm-m6j4Exploit, Patch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20230803-0005/
• https://github.com/MechanicalSoup/MechanicalSoup/commit/d57c4a269bba3b9a0c5bfa20292955b849006d9ePatch
• https://github.com/MechanicalSoup/MechanicalSoup/releases/tag/v1.3.0Release Notes
• https://github.com/MechanicalSoup/MechanicalSoup/security/advisories/GHSA-x456-3ccm-m6j4Exploit, Patch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20230803-0005/

Published

Jul 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34450CometBFT is a Byzantine Fault Tolerant (BFT) middleware that…5.3
• CVE-2023-34451CometBFT is a Byzantine Fault Tolerant (BFT) middleware that…8.2
• CVE-2023-34452Grav is a flat-file content management system. In versions 1…6.1
• CVE-2023-34453snappy-java is a fast compressor/decompressor for Java. Due …7.5
• CVE-2023-34454snappy-java is a fast compressor/decompressor for Java. Due …7.5
• CVE-2023-34455snappy-java is a fast compressor/decompressor for Java. Due …7.5
• CVE-2023-34458mx-chain-go is the official implementation of the MultiversX…5.3
• CVE-2023-34459OpenZeppelin Contracts is a library for smart contract devel…5.9
• CVE-2023-3446Issue summary: Checking excessively long DH keys or paramete…5.3
• CVE-2023-34460Tauri is a framework for building binaries for all major des…9.8
• CVE-2023-34461PyBB is an open source bulletin board. A manual code review …5.4
• CVE-2023-34462Netty is an asynchronous event-driven network application fr…6.5