GHSA-ggxf-37hm-9wqf
instagrapi: Unsafe signup challenge path handling in instagrapi
instagrapi versions before 2.6.9 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. A malicious or tampered challenge payload could cause challenge handling requests to be sent outside the intended Instagram host with the client's existing session headers. Version 2.6.9 validates challenge paths before building URLs, solving captcha challenges, or submitting phone/SMS challenge forms.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
instagrapi: Unsafe signup challenge path handling in instagrapi
instagrapi versions before 2.6.9 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. A malicious or tampered challenge payload could cause challenge handling requests to be sent outside the intended Instagram host with the client's existing session headers. Version 2.6.9 validates challenge paths before building URLs, solving captcha challenges, or submitting phone/SMS challenge forms.
- Record
GHSA-ggxf-37hm-9wqf- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
instagrapi: Unsafe signup challenge path handling in instagrapi
instagrapi versions before 2.6.9 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. A malicious or tampered challenge payload could cause challenge handling requests to be sent outside the intended Instagram host with the client's existing session headers. Version 2.6.9 validates challenge paths before building URLs, solving captcha challenges, or submitting phone/SMS challenge forms.
- Record
GHSA-ggxf-37hm-9wqf- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
instagrapiPyPI | before 2.6.9 | 2.6.9 |
instagrapiPyPI | before 2.6.9, plus listed versions 1.0.01.0.11.0.101.0.21.0.3 Show 45 moreShow less1.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.1.51.1.61.1.71.1.81.1.91.10.01.10.11.10.21.11.01.11.11.12.01.12.11.12.101.12.111.12.121.12.131.12.141.12.151.12.161.12.171.12.181.12.191.12.21.12.31.12.41.12.51.12.61.12.71.12.81.12.91.13.01.13.11.13.21.13.3 | 2.6.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-ggxf-37hm-9wqf is a medium vulnerability (CVSS 6.5) in instagrapi, published May 23, 2026. No source lists public exploit code. Fixed in instagrapi 2.6.9.
References
Left out here: 218 versions. The JSON record has them.