CVE-2025-30374

CVE-2025-30374 Class Pollution Vulnerability in Taipy Leading to RCE, XSS, DoS, and Credential Leakage Summary A class pollution vulnerability has been identified in Taipy v4.0.3 the latest version at the time of discovery. This vulnerability allows unauthorized attackers to overwrite the Taipy...

bomiot (>=0.2.86, <=0.8.5), cashd (>=0.2.0, <=0.3.4.post1) +9 more potentially affected by CVE-2026-106454 via twisted (24.7.0)

twisted PYPI version 24.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - bomiot =0.2.86, =0.2.0, =0.7.1, =0.3.1, =0.8.1, =4.0.0, =4.0.0, =0.1.0, =0.6.2, =0.1.0, =0.0.1, =0.1.5 Source cves: CVE-2026-106454 Source...

CVE-2026-85183

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

EUVD-2026-70487

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

CVE-2026-85183 Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

CVE-2026-85183

Taipy (a Python web application framework) through version 4.1.1 misconfigures its socket.io server with a wildcard CORS origin and the credential flag enabled. This allows any web page to establish credentialed WebSocket connections to a victim's Taipy application, enabling attackers to open soc...

CVE-2026-85183 Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

CVE-2026-85183 Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

CVE-2026-85183: Missing Origin Validation in WebSockets

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

PT-2026-85042

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

Exploit for CVE-2025-30374

CVE-2025-30374 Class Pollution Vulnerability in Taipy Lea...

Taipy contains a path traversal vulnerability

Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.getresource method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using...

cashd (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-48544 via taipy (3.1.0)

taipy PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on taipy and may be impacted: - cashd =0.1.0, =0.1.2 Source cves: CVE-2026-48544 Source advisory: OSV:PYSEC-2026-3081...

cashd (>=0.2.0, <=0.3.4.post1), taipy-utils (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-48544 via taipy (4.1.1)

taipy PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on taipy and may be impacted: - cashd =0.2.0, =0.1.0, =0.1.1 Source cves: CVE-2026-48544 Source advisory: OSV:PYSEC-2026-3081...

PT-2026-59700

Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get resource method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using...

CVE-2026-48544

Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.getresource method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using...

GHSA-28GH-Q3GW-PVX8 Taipy contains a path traversal vulnerability

Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.getresource method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using...

Taipy contains a path traversal vulnerability

Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.getresource method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using...

cashd (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-48544 via taipy (3.1.0)

taipy PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on taipy and may be impacted: - cashd =0.1.0, =0.1.2 Source cves: CVE-2026-48544 Source advisory: OSV:GHSA-28GH-Q3GW-PVX8...

cashd (>=0.2.0, <=0.3.4.post1), taipy-utils (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-48544 via taipy (4.1.1)

taipy PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on taipy and may be impacted: - cashd =0.2.0, =0.1.0, =0.1.1 Source cves: CVE-2026-48544 Source advisory: OSV:GHSA-28GH-Q3GW-PVX8...