Malicious Code Vulnerability in aiogram-3: Reverse Shell Exploit
Summary
MAL-2025-192940: Malicious code in aiogram-3 (PyPI). Affects aiogram-3 versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aiogram-3 is a popular Python library used for building asynchronous Telegram bots. It provides a simple interface for interacting with the Telegram Bot API, allowing developers to create feature-rich bots with ease. However, the package has been compromised, introducing a serious security vulnerability that can lead to unauthorized access to users' systems.
Vulnerability Detail
The vulnerability originates from a malicious code injection in the aiogram-3 package, specifically in version 1.0.0. Upon installation or import, the package executes a reverse shell to a hardcoded IP address (147.45.124.42), allowing attackers to run arbitrary commands on the victim's machine. This poses significant risks, including data theft, system compromise, and further exploitation of the affected environment. The malicious code overrides the install command in setup.py, ensuring that the harmful actions are executed during the installation process.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall aiogram-3If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the aiogram-3 package until a secure version is released. If you must use it, consider running it in a controlled environment, such as a virtual machine, to mitigate potential risks.
Conclusion
The aiogram-3 package has been compromised, introducing a severe vulnerability that allows attackers to execute commands on affected systems. It is essential to uninstall the compromised version and monitor your environment for any signs of exploitation. Utilizing tools like Vulert can help maintain security in your software dependencies.
See every vulnerability recorded for aiogram-3 →
FAQ
aiogram-3 is a Python library designed for building asynchronous Telegram bots, providing a user-friendly interface for developers.
The vulnerability allows attackers to execute arbitrary commands on your machine, potentially leading to data theft and system compromise.
Uninstall aiogram-3 immediately and check for any malicious activity on your system. Replace it with a secure version if available.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using Pipfile.lock. Check your application for vulnerabilities at Vulert Scanner.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring an account.
