EUVD-2023-0247

Malicious code in bioql PyPI...

EUVD-2024-38937

Malicious code in bioql PyPI...

EUVD-2024-38931

Malicious code in bioql PyPI...

EUVD-2024-38935

Malicious code in bioql PyPI...

EUVD-2024-38939

Malicious code in bioql PyPI...

EUVD-2024-38936

Malicious code in bioql PyPI...

EUVD-2024-38932

Malicious code in bioql PyPI...

EUVD-2024-38933

Malicious code in bioql PyPI...

EUVD-2024-38938

Malicious code in bioql PyPI...

EUVD-2024-38934

Malicious code in bioql PyPI...

EUVD-2022-0282

Malicious code in bioql PyPI...

Cross-site Scripting (XSS)

Overview streamlit-shortcuts is a Streamlit keyboard shortcuts for your buttons. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the addshortcuts function which fails to properly escape special characters when injecting JavaScript code into the DOM. Details...

graph-rag-poc

Graph RAG Pipeline - Proof of Concept A locally-executable Gr...

MAL-2025-20521 Malicious code in figma-to-streamlit (npm)

The package figma-to-streamlit was found to contain malicious code...

Malicious code in figma-to-streamlit (npm)

The package figma-to-streamlit was found to contain malicious code...

CVE-2024-42474

Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit apps on Windows were vulnerable to a path traversal vulnerability when the static file shari...

CVE-2023-27494

Streamlit, software for turning data scripts into web applications, had a cross-site scripting XSS vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit apps were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to ...

CVE-2022-35918

Streamlit is a data oriented application development framework for python. Users hosting Streamlit apps that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially othe...

ace-cm (>=0.0.1, <=0.0.4), active-framework (>=2.0.0, <=2.0.9) +245 more potentially affected by CVE-2025-1684 via streamlit (>=1.0.0, <=1.43.1)

streamlit PYPI version =1.0.0, =0.0.1, =2.0.0, =0.0.0, =1.2.1, =0.0.2, =1.0.0, =0.2.0, =1.0.4, =0.8.0, =0.8.41 and more Source cves: CVE-2025-1684 Source advisory: SNYK:PYTHON-STREAMLIT-8749606...

Arbitrary File Upload

Overview streamlit is a The fastest way to build data apps in Python Affected versions of this package are vulnerable to Arbitrary File Upload in the fileuploader.py widget, which does not enforce uploaded file type restrictions on the server side, even if they are set in the client. Remediation...