Shiny for Python has path traversal in bookmark restore
The source advisory has changed since this explanation was prepared. Check the current technical data and original advisory below.
Impact
Shiny for Python's bookmark-restore path accepted a client-supplied _state_id_ query-string value and joined it into the server-side bookmark directory (<cwd>/shiny_bookmarks/<id>) without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open and parse input.json and values.json from a directory outside the bookmark store.
On a default application the restore was attempted whenever the client supplied a URL query string — including when bookmarking was disabled (bookmark_store="disable") — so no opt-in configuration was required. For such applications the impact is an unauthenticated, server-side probe for the existence and JSON-validity of attacker-chosen paths, constrained to those two file names.
Applications configured with bookmark_store="server" and using ui.input_file() are affected more seriously. The file-input restore handler copies files out of the restore directory, so the contents of an attacker-selected file name within an attacker-selected directory could be read into the application.
Affected versions
1.4.0 through 1.6.3. Bookmarking was introduced in 1.4.0; earlier releases do not contain the affected code path and are not affected.
Credits
Reported by @0xRenSec.).
What to do
Patches
Fixed in 1.6.4. Upgrade with:
pip install --upgrade shinyThe fix validates bookmark IDs against an allowlist — a single path segment matching [A-Za-z0-9_-]+, which cannot express a path separator, a .. parent reference, or an absolute path — before the ID is used to build a filesystem path. Bookmark IDs generated by Shiny are unaffected by this restriction. Restore is additionally gated on the application's bookmark_store setting at a single point, so it no longer runs when bookmarking is disabled, and the on-disk restore path is honored only under bookmark_store="server".
Workarounds
There is no configuration change that mitigates this on an affected version: the restore path ran even with bookmark_store="disable". Deployments that cannot upgrade immediately can strip the _state_id_ parameter from incoming query strings at a reverse proxy or load balancer, which prevents the affected code path from being reached.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | shiny | >= 1.4.0, < 1.6.4 | 1.6.4 |
References
- https://github.com/posit-dev/py-shiny/security/advisories/GHSA-47c3-hpmg-7j6p
- https://github.com/posit-dev/py-shiny/commit/1d8ecb46cbc9621b7dc8812111d26692e086b376
- https://github.com/posit-dev/py-shiny
- https://github.com/posit-dev/py-shiny/releases/tag/v1.6.4
- https://pypi.org/project/shiny
- https://github.com/advisories/GHSA-47c3-hpmg-7j6p
- https://nvd.nist.gov/vuln/detail/CVE-2026-108258
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-22- Platform
- Python (PyPI)
- Package
shiny- Disclosed
- 09.10.2026
- Updated
- 15.10.2026 18:17
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - PYSEC-2026-4300 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-47c3-hpmg-7j6p - CC BY 4.0
Vulnerability history: shiny
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.