Approved changes feed: RSS · Atom
cpe:2.3:a:snowflake:streamlit:*:*:*:*:*:windows:*:*
part: a version: * update: *
| Vendor | Snowflake (de799455-6744-506b-babc-9114bb379007) |
|---|---|
| Product | Streamlit (9475ac14-ac91-5fad-8e86-50690d2ff5ec) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | windows |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/streamlit/streamlit |
purl2cpe | 2026-06-01 10:14:56.318951 |
pkg:pypi/streamlit |
purl2cpe | 2026-06-01 10:14:56.318953 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-33682 |
vulnerable | 2026-06-08 07:59:10.587914 |
Streamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure)
MEDIUM (4.7)
Streamlit is a data oriented application development framework for python. Streamlit Open Source versions prior to 1.54.0 running on Windows hosts have an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. The vulnerability arises from improper validation of attacker-supplied filesystem paths. In certain code paths, including within the `ComponentRequestHandler`, filesystem paths are resolved using `os.path.realpath()` or `Path.resolve()` before sufficient validation occurs. On Windows systems, supplying a malicious UNC path (e.g., `\\attacker-controlled-host\share`) can cause the Streamlit server to initiate outbound SMB connections over port 445. When Windows attempts to authenticate to the remote SMB server, NTLMv2 challenge-response credentials of the Windows user running the Streamlit process may be transmitted. This behavior may allow an attacker to perform NTLM relay attacks against other internal services and/or identify internally reachable SMB hosts via timing analysis. The vulnerability has been fixed in Streamlit Open Source version 1.54.0.
Published: 2026-03-26T21:45:05.616Z
Updated: 2026-03-27T20:00:36.574Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.