Streamlit Geospatial
Approved changes feed: RSS · Atom
cpe:2.3:a:opengeos:streamlit-geospatial:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Opengeos (9c9045d4-3305-5edf-9976-707b844044ee) |
|---|---|
| Product | Streamlit Geospatial (778aa330-bd8b-5e46-bb4a-dcc84e4d3e7a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/opengeos/streamlit-geospatial |
purl2cpe | 2026-06-01 10:12:42.178505 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-41120 |
vulnerable | 2026-06-08 06:43:54.021386 |
streamlit-geospatial blind SSRF in pages/9_🔲_Vector_Data_Visualization.py
CRITICAL (9.8)
streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `url` variable on line 63 of `pages/9_🔲_Vector_Data_Visualization.py` takes user input, which is later passed to the `gpd.read_file` method. `gpd.read_file` method creates a request to arbitrary destinations, leading to blind server-side request forgery. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.
Published: 2024-07-26T20:57:31.466Z
Updated: 2024-08-02T04:46:51.580Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41119 |
vulnerable | 2026-06-08 06:43:54.020966 |
streamlit-geospatial remote code execution in pages/8_🏜️_Raster_Data_Visualization.py
CRITICAL (9.8)
streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` variable on line 80 in `8_🏜️_Raster_Data_Visualization.py` takes user input, which is later used in the `eval()` function on line 86, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.
Published: 2024-07-26T20:54:49.052Z
Updated: 2024-08-02T04:46:52.389Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41118 |
vulnerable | 2026-06-08 06:43:54.020534 |
streamlit-geospatial blind SSRF in pages/7_📦_Web_Map_Service.py
HIGH (7.5)
streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `url` variable on line 47 of `pages/7_📦_Web_Map_Service.py` takes user input, which is passed to `get_layers` function, in which `url` is used with `get_wms_layer` method. `get_wms_layer` method creates a request to arbitrary destinations, leading to blind server-side request forgery. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.
Published: 2024-07-26T20:52:46.182Z
Updated: 2024-08-02T04:46:52.574Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41117 |
vulnerable | 2026-06-08 06:43:54.019946 |
Remote code execution in streamlit geospatial in pages/10_🌍_Earth_Engine_Datasets.py
CRITICAL (9.8)
streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` variable on line 115 in `pages/10_🌍_Earth_Engine_Datasets.py` takes user input, which is later used in the `eval()` function on line 126, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.
Published: 2024-07-26T20:49:44.689Z
Updated: 2024-08-02T04:46:52.277Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41116 |
vulnerable | 2026-06-08 06:43:54.019508 |
Remote code execution in streamlit geospatial in pages/1_📷_Timelapse.py MODIS Ocean Color SMI option vis_params
CRITICAL (9.8)
streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` variable on line 1254 in `pages/1_📷_Timelapse.py` takes user input, which is later used in the `eval()` function on line 1345, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.
Published: 2024-07-26T20:16:24.561Z
Updated: 2024-08-02T04:46:52.561Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41115 |
vulnerable | 2026-06-08 06:43:54.019091 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41114 |
vulnerable | 2026-06-08 06:43:54.018671 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41113 |
vulnerable | 2026-06-08 06:43:54.018205 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41112 |
vulnerable | 2026-06-08 06:43:54.017419 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.