GHSA-ggxf-37hm-9wqf

Source

https://github.com/advisories/GHSA-ggxf-37hm-9wqf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-ggxf-37hm-9wqf/GHSA-ggxf-37hm-9wqf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-ggxf-37hm-9wqf

Published

2026-05-23T00:12:34Z

Modified

2026-05-23T00:15:16.736069978Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

instagrapi: Unsafe signup challenge path handling in instagrapi

Details

instagrapi versions before 2.6.9 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. A malicious or tampered challenge payload could cause challenge handling requests to be sent outside the intended Instagram host with the client\'s existing session headers. Version 2.6.9 validates challenge paths before building URLs, solving captcha challenges, or submitting phone/SMS challenge forms.

Database specific

{
    "github_reviewed": true,
    "severity": "MODERATE",
    "nvd_published_at": null,
    "github_reviewed_at": "2026-05-23T00:12:34Z",
    "cwe_ids": [
        "CWE-918"
    ]
}

References

Affected packages

PyPI / instagrapi

Package

Name: instagrapi; View open source insights on deps.dev
Purl: pkg:pypi/instagrapi

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.6.9

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.7

1.2.8

1.2.9

1.3.0

1.3.1

1.3.2

1.3.5

1.3.6

1.3.7

1.3.8

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.5.0

1.5.1

1.5.2

1.5.3

1.5.5

1.5.8

1.5.9

1.5.10

1.6.1

1.6.2

1.6.3

1.6.4

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.7.10

1.7.11

1.7.12

1.7.13

1.7.14

1.7.15

1.7.16

1.7.17

1.7.19

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.8.10

1.8.11

1.8.12

1.9.0

1.9.1

1.9.2

1.9.3

1.9.4

1.9.5

1.9.6

1.9.7

1.9.8

1.9.9

1.9.10

1.9.11

1.9.12

1.9.13

1.9.14

1.9.15

1.9.16

1.9.17

1.9.18

1.9.19

1.10.0

1.10.1

1.10.2

1.11.0

1.11.1

1.12.0

1.12.1

1.12.2

1.12.3

1.12.4

1.12.5

1.12.6

1.12.7

1.12.8

1.12.9

1.12.10

1.12.11

1.12.12

1.12.13

1.12.14

1.12.15

1.12.16

1.12.17

1.12.18

1.12.19

1.13.0

1.13.1

1.13.2

1.13.3

1.13.4

1.13.5

1.13.6

1.14.0

1.14.1

1.14.2

1.14.3

1.14.4

1.14.5

1.15.0

1.15.1

1.15.2

1.15.3

1.15.4

1.15.5

1.15.6

1.15.7

1.15.8

1.15.9

1.15.10

1.15.11

1.15.12

1.15.13

1.15.14

1.15.15

1.15.16

1.15.17

1.15.19

1.15.20

1.16.1

1.16.2

1.16.3

1.16.6

1.16.7

1.16.8

1.16.9

1.16.10

1.16.11

1.16.12

1.16.13

1.16.14

1.16.15

1.16.16

1.16.17

1.16.19

1.16.20

1.16.21

1.16.22

1.16.23

1.16.24

1.16.25

1.16.26

1.16.27

1.16.29

1.16.30

1.16.31

1.16.32

1.16.33

1.16.41

1.16.42

1.17.0

1.17.1

1.17.2

1.17.3

1.17.4

1.17.5

1.17.6

1.17.7

1.17.8

1.17.9

1.17.10

1.17.12

1.17.13

1.18.1

1.18.2

1.18.3

1.18.4

1.18.5

1.19.1

1.19.2

1.19.3

1.19.4

1.19.5

1.19.6

1.19.7

1.19.8

2.*

2.0.0

2.0.1

2.0.3

2.1.1

2.1.2

2.1.3

2.1.5

2.2.1

2.3.0

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.5.7

2.5.8

2.5.9

2.5.10

2.5.11

2.5.13

2.5.14

2.5.15

2.5.16

2.5.17

2.5.18

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.6.6

2.6.7

2.6.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-ggxf-37hm-9wqf/GHSA-ggxf-37hm-9wqf.json"