CVE-2024-41112

Remote code execution in streamlit geospatial in pages/1_📷_Timelapse.py Any Earth Engine ImageCollection option palette

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable in `pages/1_📷_Timelapse.py` takes user input, which is later used in the `eval()` function on line 380, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.

Affected

opengeos · streamlit-geospatial

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.40% chance of exploitation in the next 30 days, 72nd percentile

Published

2024-07-26

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatia…

Security advisories

• https://securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatial
• opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489

References

• CVE Record
• NVD entry