Streamlit-Geospatial Security Vulnerabilities - January

CVE-2024-41112

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable in pages/1_?_Timelapse.py takes user input, which is later used in the eval() function on line 380, leading to remote code execution. Commit ...

CVE-2024-41113

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the vis_params variable on line 383 or line 390 in pages/1_?_Timelapse.py takes user input, which is later used in the eval() function on line 395, leading to rem...

CVE-2024-41114

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable on line 430 in pages/1_?_Timelapse.py takes user input, which is later used in the eval() function on line 435, leading to remote code execut...

CVE-2024-41115

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable on line 488 in pages/1_?_Timelapse.py takes user input, which is later used in the eval() function on line 493, leading to remote code execut...

CVE-2024-41116

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the vis_params variable on line 1254 in pages/1_?_Timelapse.py takes user input, which is later used in the eval() function on line 1345, leading to remote code e...

CVE-2024-41117

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the vis_params variable on line 115 in pages/10_?_Earth_Engine_Datasets.py takes user input, which is later used in the eval() function on line 126, leading to re...

CVE-2024-41118

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the url variable on line 47 of pages/7_?_Web_Map_Service.py takes user input, which is passed to get_layers function, in which url is used with get_wms_layer meth...

CVE-2024-41119

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the vis_params variable on line 80 in 8_??_Raster_Data_Visualization.py takes user input, which is later used in the eval() function on line 86, leading to remote...

CVE-2024-41120

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the url variable on line 63 of pages/9_?_Vector_Data_Visualization.py takes user input, which is later passed to the gpd.read_file method. gpd.read_file method cr...