Media

Minor fix to previous patch for CVE-2022-35918

Publicada: 12.01.2024
Actualizado: 11.10.2026 12:20

Impact

The initial vulnerability identified in Streamlit apps using custom components, allowing for directory traversal attacks, was addressed in version 1.11.1. However, a minor issue persisted, which could still potentially expose certain files on the server file-system under specific conditions.

Patches

We released an update in version 1.30.0 to further tighten security measures. Users are strongly advised to update to version 1.30.0 immediately for optimal security.

Workarounds

No additional workarounds are necessary once the update to version 1.30.0 is applied.

For more information

If you have any questions or comments about this advisory:

Email us at security@streamlit.io

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	streamlit	>= 0.63.0, < 1.30.0	1.30.0

Referencias

Puntuación CVSS 5.3/10

Vector CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Debilidad (CWE): CWE-22
Plataforma: Python (PyPI)
Paquete: streamlit
Publicada: 12.01.2024
Actualizado: 11.10.2026 12:20

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-8qw9-gf7w-42x5 - CC BY 4.0

Historial de vulnerabilidades: streamlit

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Entradas en total: 6
Primera → última: 08.2022 06.2026
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Media 6

Divulgaciones por año

2022: 1
2023: 1
2024: 2
2025: 0
2026: 2

04.06.2026

A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation le

Media · 4.7 CVE-2026-10804 < 1.53.1 1.53.1
25.03.2026

Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)

Media · 4.7 CVE-2026-33682 < 1.54.0 1.54.0
12.08.2024

Path traveral in Streamlit on windows

Media · 5.9 CVE-2024-42474 < 1.37.0 1.37.0
12.01.2024

Minor fix to previous patch for CVE-2022-35918 esta entrada

Media · 5.3 ghsa-8qw9-gf7w-42x5 >= 0.63.0, < 1.30.0 1.30.0
16.03.2023

Streamlit publishes previously-patched Cross-site Scripting vulnerability

Media · 5.9 CVE-2023-27494 >= 0.63.0, < 0.81.0 0.81.0
01.08.2022

Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data

Media · 6.5 CVE-2022-35918 >= 0.63.0, < 1.11.1 1.11.1

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación