CVE-2024-42474

Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit apps on Windows were vulnerable to a path traversal vulnerability when the static file shari...

CVE-2023-27494

Streamlit, software for turning data scripts into web applications, had a cross-site scripting XSS vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit apps were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to ...

CVE-2022-35918

Streamlit is a data oriented application development framework for python. Users hosting Streamlit apps that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially othe...

ace-cm (>=0.0.1, <=0.0.4), active-framework (>=2.0.0, <=2.0.9) +244 more potentially affected by CVE-2025-1684 via streamlit (>=1.0.0, <=1.43.1)

streamlit PYPI version =1.0.0, =0.0.1, =2.0.0, =0.0.0, =1.2.1, =0.0.2, =1.0.0, =0.2.0, =1.0.4, =0.8.0, =0.8.41 and more Source cves: CVE-2025-1684 Source advisory: SNYK:PYTHON-STREAMLIT-8749606...

Arbitrary File Upload

Overview streamlit is a The fastest way to build data apps in Python Affected versions of this package are vulnerable to Arbitrary File Upload in the fileuploader.py widget, which does not enforce uploaded file type restrictions on the server side, even if they are set in the client. Remediation...

CVE-2024-41118

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the url variable on line 47 of pages/7📦WebMapService.py takes user input, which is passed to getlayers function, in which url is used with getwmslayer method...

CVE-2024-41114

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable on line 430 in pages/1📷Timelapse.py takes user input, which is later used in the eval function on line 435, leading to remote code executio...

CVE-2024-41115

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable on line 488 in pages/1📷Timelapse.py takes user input, which is later used in the eval function on line 493, leading to remote code executio...

CVE-2024-41119

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the visparams variable on line 80 in 8🏜️RasterDataVisualization.py takes user input, which is later used in the eval function on line 86, leading to remote code...

CVE-2024-41120

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the url variable on line 63 of pages/9🔲VectorDataVisualization.py takes user input, which is later passed to the gpd.readfile method. gpd.readfile method create...

NTLM Credential Theft Risk in Python Apps Threaten Windows Security

New research reveals critical vulnerabilities in Python applications for Windows including Snowflake, Gradio, Jupyter, and Streamlit that could…...

Path Traversal

Streamlit is vulnerable to a Path Traversal. The vulnerability is due to improper handling of file paths in the static file sharing feature of Streamlit on Windows systems, which allows an attacker to traverse directories and access the password hash of the Windows user running Streamlit...

Path traveral in Streamlit on windows

Impacted Products Streamilt Open Source versions before 1.37.0. 2. Introduction Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The...

GHSA-RXFF-VR5R-8CJ5 Path traveral in Streamlit on windows

Impacted Products Streamilt Open Source versions before 1.37.0. 2. Introduction Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The...

pull-the-pitcher (>=0.1.6, <=0.1.11) potentially affected by CVE-2024-42474 via streamlit (0.6.0)

streamlit PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - pull-the-pitcher =0.1.6, =0.1.11 Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...

onelearn (>=0.1.1, <=0.3.0) potentially affected by CVE-2024-42474 via streamlit (0.49.0)

streamlit PYPI version 0.49.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - onelearn =0.1.1, =0.3.0 Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...

wraplot (0.1.1) potentially affected by CVE-2024-42474 via streamlit (0.51.0)

streamlit PYPI version 0.51.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - wraplot 0.1.1 Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...

punditkit (0.0.1) potentially affected by CVE-2024-42474 via streamlit (0.52.2)

streamlit PYPI version 0.52.2 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - punditkit 0.0.1 Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...

colornet (0.2.0), keras-metric-learning (0.2.0) +5 more potentially affected by CVE-2024-42474 via streamlit (0.53.0)

streamlit PYPI version 0.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - colornet 0.2.0 - keras-metric-learning 0.2.0 - neural-art 0.2.0 - openleveldb 0.1.0 - punditkit 0.0.2 - pyraytracer 0.2.0 - pytorchjeeves 0.2...

covid-models (>=0.1.1, <=0.1.2) potentially affected by CVE-2024-42474 via streamlit (0.57.3)

streamlit PYPI version 0.57.3 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - covid-models =0.1.1, =0.1.2 Source cves: CVE-2024-42474 Source advisory: OSV:GHSA-RXFF-VR5R-8CJ5...