Threat Investigation
Request a demo

CVE-2024-41115

Critical

Description

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `palette` variable on line 488 in `pages/1_📷_Timelapse.py` takes user input, which is later used in the `eval()` function on line 493, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.

SeverityCritical
CVSS9.8
Exploit probability—
ProductOpengeos Streamlit-geospatial
PublishedJul 26, 2024
First seenJul 26, 2024
Weakness typeCWE-20Improper input validation

How to fix

Update
  • opengeos streamlit-geospatial2024-07-19 or later

Affected products

ProductAffected versionsFixed in
opengeos streamlit-geospatialv < 2024-07-192024-07-19

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.