CVE-2024-41112

published 2024-07-26

CVE-2024-41112: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable…

Priority P2 60 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable in `pages/1_📷_Timelapse.py` takes user input, which is later used in the `eval()` function on line 380, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
opengeos	streamlit-geospatial	< c4f81d9616d40c60584e36abb15300853a66e489	c4f81d9616d40c60584e36abb15300853a66e489
opengeos	streamlit-geospatial	< 2024-07-19	2024-07-19

Detection & IOCs extracted from sources · hover to see the quote

path pages/1_📷_Timelapse.py↗

hash c4f81d9616d40c60584e36abb15300853a66e489↗

• → Monitor for unsanitized user input passed to Python eval() at line 380 of pages/1_📷_Timelapse.py in streamlit-geospatial; any exploitation will route through this eval() call and can execute arbitrary OS commands. ↗

• · The vulnerability exists in commits prior to c4f81d9616d40c60584e36abb15300853a66e489; deployments running unpatched versions of streamlit-geospatial are exposed to RCE via the palette parameter. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20