CVE-2024-41112
Critical
Description
streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable in `pages/1_📷_Timelapse.py` takes user input, which is later used in the `eval()` function on line 380, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.
SeverityCritical
CVSS9.8
Exploit probability—
ProductOpengeos Streamlit-geospatial
PublishedJul 26, 2024
First seenJul 26, 2024
Weakness typeCWE-20Improper input validation
How to fix
Update
- opengeos streamlit-geospatial2024-07-19 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opengeos streamlit-geospatial | v < 2024-07-19 | 2024-07-19 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.