Dash Framework - Cross-site Scripting

Dash framework versions before 2.15.0 are vulnerable to Cross-site Scripting XSS via href attribute in anchor tags. This template tests for javascript:alert payload injection. id: CVE-2024-21485 info: name: Dash Framework - Cross-site Scripting author: Lee Changhyuneeche severity: medium...

tshistory-editor (0.8.2), tshistory-refinery (>=0.1.0, <=0.5.0) +1 more potentially affected by CVE-2024-21485 via dash-core-components (1.10.1)

dash-core-components PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - tshistory-editor 0.8.2 - tshistory-refinery =0.1.0, =0.11.1, =0.15.1 Source cves: CVE-2024-21485 Source advisory:...

django-dash-ddx-catalog (>=0.1.0, <=0.1.1), shapash (>=1.0.0, <=1.7.1) potentially affected by CVE-2024-21485 via dash-core-components (1.13.0)

dash-core-components PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - django-dash-ddx-catalog =0.1.0, =1.0.0, =1.7.1 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-219...

echelon8-test (0.0.1) potentially affected by CVE-2024-21485 via dash-core-components (0.22.2)

dash-core-components PYPI version 0.22.2 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - echelon8-test 0.0.1 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-219...

interpret (>=0.0.2, <=0.1.13) potentially affected by CVE-2024-21485 via dash-core-components (0.44.0)

dash-core-components PYPI version 0.44.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - interpret =0.0.2, =0.1.13 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-219...

famcy (0.0.2), fn-graph-studio (>=0.1.0, <=0.10.5) +1 more potentially affected by CVE-2024-21485 via dash-core-components (1.17.1)

dash-core-components PYPI version 1.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - famcy 0.0.2 - fn-graph-studio =0.1.0, =0.2.0, =0.5.0 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-219...

divik (>=2.0.0b0, <=2.3.6) potentially affected by CVE-2024-21485 via dash-core-components (0.42.0)

dash-core-components PYPI version 0.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - divik =2.0.0b0, =2.3.6 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-219...

echelon8-test (0.0.1) potentially affected by CVE-2024-21485 via dash-html-components (0.10.1)

dash-html-components PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - echelon8-test 0.0.1 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

dash (2.0.0rc3), django-dash-ddx-catalog (>=0.1.2, <=0.1.3) potentially affected by CVE-2024-21485 via dash-html-components (2.0.0rc1)

dash-html-components PYPI version 2.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - dash 2.0.0rc3 - django-dash-ddx-catalog =0.1.2, =0.1.3 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-22...

django-dash-ddx-catalog (>=0.1.0, <=0.1.1), famcy (0.0.2) potentially affected by CVE-2024-21485 via dash-html-components (1.1.4)

dash-html-components PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - django-dash-ddx-catalog =0.1.0, =0.1.1 - famcy 0.0.2 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

datadriver (>=0.1.0, <=0.1.3), ddui (3.0.4) potentially affected by CVE-2024-21485 via dash-html-components (0.13.5)

dash-html-components PYPI version 0.13.5 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - datadriver =0.1.0, =0.1.3 - ddui 3.0.4 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

shapash (>=1.0.0, <=1.7.1) potentially affected by CVE-2024-21485 via dash-html-components (1.1.1)

dash-html-components PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - shapash =1.0.0, =1.7.1 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

CVE-2024-21485

creationtimestamp| type| source ---|---|--- 2024-02-02 06:31:40+00:00| seen| https://t.me/ctinow/177926 2024-02-10 08:16:23+00:00| seen| https://t.me/ctinow/182459 2024-02-24 14:16:35+00:00| seen| https://t.me/ctinow/192595 2025-03-27 21:02:04+00:00| seen|...

echelon8-test (0.0.1) potentially affected by CVE-2024-21485 via dash (0.21.1)

dash PYPI version 0.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash and may be impacted: - echelon8-test 0.0.1 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...

divik (>=2.0.0b0, <=2.3.6) potentially affected by CVE-2024-21485 via dash (0.34.0)

dash PYPI version 0.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash and may be impacted: - divik =2.0.0b0, =2.3.6 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...

magani (2020.2.0) potentially affected by CVE-2024-21485 via dash-core-components (1.4.0)

dash-core-components PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - magani 2020.2.0 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...

ddui (3.0.3), interpret (>=0.0.2, <=0.1.13) potentially affected by CVE-2024-21485 via dash (0.39.0)

dash PYPI version 0.39.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash and may be impacted: - ddui 3.0.3 - interpret =0.0.2, =0.1.13 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...

cellyzer-gui (>=0.0.1, <=1.0.0), django-plotly-dash (>=1.2.0, <=1.3.1) +2 more potentially affected by CVE-2024-21485 via dash (1.10.0)

dash PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash and may be impacted: - cellyzer-gui =0.0.1, =1.2.0, =0.2.3, =0.2.7 - webviz-subsurface 0.0.31 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...

divik (>=2.0.0b0, <=2.3.6) potentially affected by CVE-2024-21485 via dash-html-components (0.13.4)

dash-html-components PYPI version 0.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - divik =2.0.0b0, =2.3.6 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...

echelon8-test (0.0.1) potentially affected by CVE-2024-21485 via dash-core-components (0.22.2)

dash-core-components PYPI version 0.22.2 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - echelon8-test 0.0.1 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...