89 matches found
CVE-2026-108258
A flaw was found in Shiny. The bookmark restore functionality fails to properly validate client-supplied state identifiers, resulting in a path traversal vulnerability. An unauthenticated remote attacker can exploit this flaw by submitting directory traversal sequences or absolute paths to access...
photfun (>=0.1.0, <=0.1.15), pycompound (>=0.0.9, <=0.1.22) +4 more potentially affected by CVE-2026-108258 via shiny (1.4.0)
shiny PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on shiny and may be impacted: - photfun =0.1.0, =0.0.9, =0.0.1a0, =0.2.1, =0.1.2, =0.1.3 Source cves: CVE-2026-108258 Source advisory: OSV:PYSEC-2026-4300...
Shiny for Python has path traversal in bookmark restore
ImpactShiny for Python's bookmark-restore path accepted a client-supplied stateidquery-string value and joined it into the server-side bookmark directory/shinybookmarks/ without validating it. A value containing ..path segments, or an absolute path, could therefore cause the server to open andpar...
PYSEC-2026-4300 Shiny for Python has path traversal in bookmark restore
Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...
CVE-2026-108258
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...
photfun (>=0.1.0, <=0.1.15), pycompound (>=0.0.9, <=0.1.22) +4 more potentially affected by CVE-2026-108258 via shiny (1.4.0)
shiny PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on shiny and may be impacted: - photfun =0.1.0, =0.0.9, =0.0.1a0, =0.2.1, =0.1.2, =0.1.3 Source cves: CVE-2026-108258 Source advisory: OSV:GHSA-47C3-HPMG-7J6P...
Shiny for Python has path traversal in bookmark restore
Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...
photfun (>=0.1.0, <=0.1.15), pycompound (>=0.0.9, <=0.1.22) +4 more potentially affected by CVE-2026-108258 via shiny (1.4.0)
shiny PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on shiny and may be impacted: - photfun =0.1.0, =0.0.9, =0.0.1a0, =0.2.1, =0.1.2, =0.1.3 Source cves: CVE-2026-108258 Source advisory: GHSA-47C3-HPMG-7J6P...
GHSA-47C3-HPMG-7J6P Shiny for Python has path traversal in bookmark restore
Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...
CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...
CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...
EUVD-2026-95986
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...
CVE-2026-108258
Shiny for Python versions 1.4.0 through 1.6.4 are vulnerable to a path traversal flaw in the bookmark restore functionality. The application fails to validate that the client-supplied state_id is a single safe path segment before joining it with the server-side shiny_bookmarks directory. This all...
photfun (>=0.1.0, <=0.1.15), pycompound (>=0.0.9, <=0.1.22) +4 more potentially affected by CVE-2026-108258 via shiny (1.4.0)
shiny PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on shiny and may be impacted: - photfun =0.1.0, =0.0.9, =0.0.1a0, =0.2.1, =0.1.2, =0.1.3 Source cves: CVE-2026-108258 Source advisory: MEND:CVE-2026-108258...
CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...
CVE-2026-108258
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...
PT-2026-109313
Name of the Vulnerable Software and Affected Versions Shiny for Python versions 1.4.0 through 1.6.3 Description The bookmark restore process accepts a client-supplied state id query-string value and joins it into the server-side bookmark directory without proper validation. An unauthenticated...
CVE-2026-108258: Improper Limitation of a Pathname to a Restricted Directory
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...
Posit Shiny for Python: Path traversal vulnerability
Posit Shiny for Python versions 1.4.0 to 1.6.4 had a path traversal vulnerability. This vulnerability stemmed from the bookmark restoration function’s acceptance of stateid provided by the client. The function did not verify whether it was a single secure path segment before appending it to the...
Malicious code in do-wnload-available-36615-big-shiny-cars-skip6-dggtzj (npm)
The package do-wnload-available-36615-big-shiny-cars-skip6-dggtzj was found to contain malicious code. --- Credit: OpenSSF source...