CVE-2026-10804

A flaw was found in Streamlit, within its Palette Handler component. This vulnerability stems from the use of a weak hashing algorithm. A local attacker could exploit this flaw, though it requires a high level of technical complexity. Successful exploitation may lead to a low impact on the...

anomalydetection (0.0.0.dev1), dataprep (>=0.2.10a0, <=0.2.14) +12 more potentially affected by CVE-2026-49854 via tornado (5.0.2)

tornado PYPI version 5.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - anomalydetection 0.0.0.dev1 - dataprep =0.2.10a0, =1.4.0, =0.2.3, =0.10.4, =3.0.4, =1.3.0, =1.1.0, =0.0.6rc1, =0.5.18, =0.5.21 Source cves:...

Embedded Malicious Code

Overview mflux-streamlit is a Streamlit WebUI application for the mflux project. Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that h...

MAL-2026-5301 Malicious code in mflux-streamlit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9924feddaacd4b86934ddc7bdf8ff498921a80b34bf99a9136baa592fcc504b6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

ace-cm (>=0.0.1, <=0.0.4), active-framework (>=2.0.0, <=2.0.9) +372 more potentially affected by CVE-2026-10804 via streamlit (>=1.0.0, <=1.58.0)

streamlit PYPI version =1.0.0, =0.0.1, =2.0.0, =0.0.0, =1.2.1, =0.14.0, =0.0.2, =0.1.0, =0.1.6, =2026.6.20, =0.1.12, =1.1.74b0, =0.0.0, =1.49.1 - aiagents4pharma-ansh 0.0.0 and more Source cves: CVE-2026-10804 Source advisory: SNYK:PYTHON-STREAMLIT-17176399...

Use of Weak Hash

Overview streamlit is a The fastest way to build data apps in Python Affected versions of this package are vulnerable to Use of Weak Hash due to the use of a weak hash algorithm in the hashing.py process of the Palette Handler component. An attacker can compromise data integrity or cause unintend...

Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission

A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a...

pull-the-pitcher (>=0.1.6, <=0.1.11) potentially affected by CVE-2026-10804 via streamlit (0.6.0)

streamlit PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - pull-the-pitcher =0.1.6, =0.1.11 Source cves: CVE-2026-10804 Source advisory: OSV:GHSA-VQWP-45WM-R9R5...

onelearn (>=0.1.1, <=0.3.0) potentially affected by CVE-2026-10804 via streamlit (0.49.0)

streamlit PYPI version 0.49.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - onelearn =0.1.1, =0.3.0 Source cves: CVE-2026-10804 Source advisory: OSV:GHSA-VQWP-45WM-R9R5...

wraplot (0.1.1) potentially affected by CVE-2026-10804 via streamlit (0.51.0)

streamlit PYPI version 0.51.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - wraplot 0.1.1 Source cves: CVE-2026-10804 Source advisory: OSV:GHSA-VQWP-45WM-R9R5...

punditkit (0.0.1) potentially affected by CVE-2026-10804 via streamlit (0.52.2)

streamlit PYPI version 0.52.2 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - punditkit 0.0.1 Source cves: CVE-2026-10804 Source advisory: OSV:GHSA-VQWP-45WM-R9R5...

colornet (0.2.0), keras-metric-learning (0.2.0) +5 more potentially affected by CVE-2026-10804 via streamlit (0.53.0)

streamlit PYPI version 0.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - colornet 0.2.0 - keras-metric-learning 0.2.0 - neural-art 0.2.0 - openleveldb 0.1.0 - punditkit 0.0.2 - pyraytracer 0.2.0 - pytorchjeeves 0.2...

covid-models (>=0.1.1, <=0.1.2) potentially affected by CVE-2026-10804 via streamlit (0.57.3)

streamlit PYPI version 0.57.3 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - covid-models =0.1.1, =0.1.2 Source cves: CVE-2026-10804 Source advisory: OSV:GHSA-VQWP-45WM-R9R5...

sapsan (>=0.1.1, <=0.3.0) potentially affected by CVE-2026-10804 via streamlit (0.58.0)

streamlit PYPI version 0.58.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - sapsan =0.1.1, =0.3.0 Source cves: CVE-2026-10804 Source advisory: OSV:GHSA-VQWP-45WM-R9R5...

neuralartstudio (0.1.0) potentially affected by CVE-2026-10804 via streamlit (0.61.0)

streamlit PYPI version 0.61.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - neuralartstudio 0.1.0 Source cves: CVE-2026-10804 Source advisory: OSV:GHSA-VQWP-45WM-R9R5...

mars-gym (0.1.0) potentially affected by CVE-2026-10804 via streamlit (0.62.0)

streamlit PYPI version 0.62.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - mars-gym 0.1.0 Source cves: CVE-2026-10804 Source advisory: OSV:GHSA-VQWP-45WM-R9R5...

raylab (>=0.8.3, <=0.10.7) potentially affected by CVE-2026-10804 via streamlit (0.62.1)

streamlit PYPI version 0.62.1 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - raylab =0.8.3, =0.10.7 Source cves: CVE-2026-10804 Source advisory: OSV:GHSA-VQWP-45WM-R9R5...

pull-the-pitcher (>=0.1.12, <=0.1.14), raylab (>=0.10.8, <=0.11.0) potentially affected by CVE-2026-10804 via streamlit (0.63.1)

streamlit PYPI version 0.63.1 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - pull-the-pitcher =0.1.12, =0.10.8, =0.11.0 Source cves: CVE-2026-10804 Source advisory: OSV:GHSA-VQWP-45WM-R9R5...

libra (1.2.2), pymedphys (>=0.32.0.dev5, <=0.32.0) +1 more potentially affected by CVE-2026-10804 via streamlit (0.64.0)

streamlit PYPI version 0.64.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - libra 1.2.2 - pymedphys =0.32.0.dev5, =0.11.1, =0.12.1 Source cves: CVE-2026-10804 Source advisory: OSV:GHSA-VQWP-45WM-R9R5...

maupassant (0.1.1) potentially affected by CVE-2026-10804 via streamlit (0.65.0)

streamlit PYPI version 0.65.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - maupassant 0.1.1 Source cves: CVE-2026-10804 Source advisory: OSV:GHSA-VQWP-45WM-R9R5...