PYSEC-2026-220

Versions of the package dash-core-components before 2.13.0; all versions of the package dash-core-components; versions of the package dash before 2.15.0; all versions of the package dash-html-components; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site...

tshistory-editor (>=0.2.0, <=0.4.0), tsview (>=0.2.0, <=0.2.1) potentially affected by CVE-2024-21485 via dash-html-components (0.10.0)

dash-html-components PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - tshistory-editor =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

echelon8-test (0.0.1) potentially affected by CVE-2024-21485 via dash-html-components (0.10.1)

dash-html-components PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - echelon8-test 0.0.1 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

divik (>=2.0.0b0, <=2.3.6) potentially affected by CVE-2024-21485 via dash-html-components (0.13.4)

dash-html-components PYPI version 0.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - divik =2.0.0b0, =2.3.6 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

datadriver (>=0.1.0, <=0.1.3), ddui (3.0.4) potentially affected by CVE-2024-21485 via dash-html-components (0.13.5)

dash-html-components PYPI version 0.13.5 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - datadriver =0.1.0, =0.1.3 - ddui 3.0.4 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

interpret (>=0.0.2, <=0.1.13) potentially affected by CVE-2024-21485 via dash-html-components (0.14.0)

dash-html-components PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - interpret =0.0.2, =0.1.13 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

buzzword (>=1.2.1, <=1.2.3), tshistory-editor (>=0.5.0, <=0.8.1) +1 more potentially affected by CVE-2024-21485 via dash-html-components (1.0.0)

dash-html-components PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - buzzword =1.2.1, =0.5.0, =0.6.0, =0.11.0 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

dash-tokamak (1.6.0), magani (2020.2.0) potentially affected by CVE-2024-21485 via dash-html-components (1.0.1)

dash-html-components PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - dash-tokamak 1.6.0 - magani 2020.2.0 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

dragg (0.0.0), dragg-gym (0.0.1) +6 more potentially affected by CVE-2024-21485 via dash-html-components (1.0.3)

dash-html-components PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - dragg 0.0.0 - dragg-gym 0.0.1 - simba-uw-no-tf =1.2.9.2, =0.70.0, =0.10.0, =0.1.0, =0.11.1, =0.15.1 Source cves:...

shapash (>=1.0.0, <=1.7.1) potentially affected by CVE-2024-21485 via dash-html-components (1.1.1)

dash-html-components PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - shapash =1.0.0, =1.7.1 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

june (>=1.1.0, <=1.1.2), rarity (>=1.0.0.dev9, <=1.0.2) potentially affected by CVE-2024-21485 via dash-html-components (1.1.3)

dash-html-components PYPI version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - june =1.1.0, =1.0.0.dev9, =1.0.2 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

django-dash-ddx-catalog (>=0.1.0, <=0.1.1), famcy (0.0.2) potentially affected by CVE-2024-21485 via dash-html-components (1.1.4)

dash-html-components PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - django-dash-ddx-catalog =0.1.0, =0.1.1 - famcy 0.0.2 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

dash (2.0.0rc3), django-dash-ddx-catalog (>=0.1.2, <=0.1.3) potentially affected by CVE-2024-21485 via dash-html-components (2.0.0rc1)

dash-html-components PYPI version 2.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - dash 2.0.0rc3 - django-dash-ddx-catalog =0.1.2, =0.1.3 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-22...

PYSEC-2026-219

Versions of the package dash-core-components before 2.13.0; all versions of the package dash-core-components; versions of the package dash before 2.15.0; all versions of the package dash-html-components; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site...

CVE-2024-21485

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

shapash (>=1.0.0, <=1.7.1) potentially affected by CVE-2024-21485 via dash-html-components (1.1.1)

dash-html-components PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - shapash =1.0.0, =1.7.1 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...

dash-tokamak (1.6.0), magani (2020.2.0) potentially affected by CVE-2024-21485 via dash-html-components (1.0.1)

dash-html-components PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - dash-tokamak 1.6.0 - magani 2020.2.0 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...

dash (2.0.0rc3), django-dash-ddx-catalog (>=0.1.2, <=0.1.3) potentially affected by CVE-2024-21485 via dash-html-components (2.0.0rc1)

dash-html-components PYPI version 2.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - dash 2.0.0rc3 - django-dash-ddx-catalog =0.1.2, =0.1.3 Source cves: CVE-2024-21485 Source advisory: GHSA-547X-748V-VP...

dash (2.0.0rc3), django-dash-ddx-catalog (>=0.1.2, <=0.1.3) potentially affected by CVE-2024-21485 via dash-html-components (2.0.0rc1)

dash-html-components PYPI version 2.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - dash 2.0.0rc3 - django-dash-ddx-catalog =0.1.2, =0.1.3 Source cves: CVE-2024-21485 Source advisory:...

django-dash-ddx-catalog (>=0.1.0, <=0.1.1), famcy (0.0.2) potentially affected by CVE-2024-21485 via dash-html-components (1.1.4)

dash-html-components PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - django-dash-ddx-catalog =0.1.0, =0.1.1 - famcy 0.0.2 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6...