CVE-2024-41120

🗓️ 26 Jul 2024 20:57:31Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 50 Views🌐 WEB

streamlit-geospatial app SSRF vulnerability fixed in commit c4f81d9616d40c60584e36abb15300853a66e48

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2024-41120	26 Jul 202423:53	–	circl
CNNVD	streamlit-geospatial 代码问题漏洞	26 Jul 202400:00	–	cnnvd
Cvelist	CVE-2024-41120 streamlit-geospatial blind SSRF in pages/9_🔲_Vector_Data_Visualization.py	26 Jul 202420:57	–	cvelist
EUVD	EUVD-2024-38939	3 Oct 202520:07	–	euvd
NVD	CVE-2024-41120	26 Jul 202421:15	–	nvd
OSV	CVE-2024-41120 streamlit-geospatial blind SSRF in pages/9_🔲_Vector_Data_Visualization.py	26 Jul 202420:57	–	osv
Positive Technologies	PT-2024-29276	26 Jul 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-41120	5 Feb 202507:41	–	redhatcve
Vulnrichment	CVE-2024-41120 streamlit-geospatial blind SSRF in pages/9_🔲_Vector_Data_Visualization.py	26 Jul 202420:57	–	vulnrichment

NVD

Vulnrichment

Node

opengeos streamlit-geospatialRange<2024-07-19

[
  {
    "vendor": "opengeos",
    "product": "streamlit-geospatial",
    "versions": [
      {
        "version": "< c4f81d9616d40c60584e36abb15300853a66e489",
        "status": "affected"
      }
    ]
  }
]

Source	Link
securitylab	www.securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatial/
github	www.github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/9_%F0%9F%94%B2_Vector_Data_Visualization.py
github	www.github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489
github	www.github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/9_%F0%9F%94%B2_Vector_Data_Visualization.py

Parameter	Position	Path	Description	CWE
url	path	pages/9_🔲_Vector_Data_Visualization.py	User input is passed to gpd.read_file, enabling SSRF to arbitrary destinations (blind server-side request forgery).	CWE-20, CWE-918

17 Jun 2026 07:47Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.00786

SSVC