AIKIDO-2026-633957
aiosonic is vulnerable to Use of Insufficiently Random Values
37
Low Risk
This Affects:
aiosonicTL;DR
The MultipartForm helper builds its multipart boundary with the non-cryptographic random module. Field values are written between the boundary delimiters without escaping, so a value that contains a guessed boundary is emitted. Code that mixes externally influenced text fields with trusted fields in a single form lets a caller who can retry the request or predict the PRNG inject a forged multipart part into the body sent upstream. The fix derives the boundary from a cryptographically secure token in both multipart upload paths.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application passes untrusted input into a MultipartForm field alongside application-controlled fields.
Background info
aiosonic is vulnerable to Use of Insufficiently Random Values in versions 0.0.1 - 1.0.3.
How to fix this
Upgrade the aiosonic library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant