CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2023-27494
Medium (6.1) in snowflake streamlit. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in streamlit 0.81.0.
Streamlit, software for turning data scripts into web applications, had a cross-site scripting (XSS) vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit app(s) were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to a Streamlit app. The attacker could then trick the user into visiting the malicious URL and, if successful, the server would render the malicious javascript payload as-is, leading to XSS. Version 0.81.0 contains a patch for this vulnerability.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- snowflake:streamlit
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9c6g-qpgj-rvxw | PyPI | streamlit | >=0.63.0 <0.81.0 | 0.81.0 |
| PYSEC-2023-50 | PyPI | streamlit | >=0.63.0 <0.81.0 | 0.81.0 |
References
- https://github.com/streamlit/streamlit/commit/afcf880c60e5d7538936cc2d9721b9e1bc02b075
- https://github.com/streamlit/streamlit/security/advisories/GHSA-9c6g-qpgj-rvxw
- https://github.com/streamlit/streamlit/commit/afcf880c60e5d7538936cc2d9721b9e1bc02b075
- https://github.com/streamlit/streamlit/security/advisories/GHSA-9c6g-qpgj-rvxw