CVE-2024-41119

streamlit-geospatial remote code execution in pages/8_🏜️_Raster_Data_Visualization.py

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` variable on line 80 in `8_🏜️_Raster_Data_Visualization.py` takes user input, which is later used in the `eval()` function on line 86, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.

Affected

opengeos · streamlit-geospatial

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.40% chance of exploitation in the next 30 days, 72nd percentile

Published

2024-07-26

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatia…

Security advisories

• https://securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatial
• opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489

References

• CVE Record
• NVD entry