Back to Database
Status published
Critical
CVE-2024-41114
Remote code execution in streamlit geospatial in pages/1_📷_Timelapse.py MODIS Gap filled Land Surface Temperature Daily option
Vulnerability Description
streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `palette` variable on line 430 in `pages/1_📷_Timelapse.py` takes user input, which is later used in the `eval()` function on line 435, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-41114
Credits & Attribution
No credits recorded in the NVD database.
References
- https://securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatial/
- https://github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489
- https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/1_%F0%9F%93%B7_Timelapse.py#L430
- https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/1_%F0%9F%93%B7_Timelapse.py#L435
More from opengeos
View All →CVE-2024-41120
streamlit-geospatial blind SSRF in pages/9_🔲_Vector_Data_Visualization.py
Critical
9.8
CVE-2024-41119
streamlit-geospatial remote code execution in pages/8_🏜️_Raster_Data_Visualization.py
Critical
9.8
CVE-2024-41118
streamlit-geospatial blind SSRF in pages/7_📦_Web_Map_Service.py
High
7.5
CVE-2024-41117
Remote code execution in streamlit geospatial in pages/10_🌍_Earth_Engine_Datasets.py
Critical
9.8
CVE-2024-41116
Remote code execution in streamlit geospatial in pages/1_📷_Timelapse.py MODIS Ocean Color SMI option vis_params
Critical
9.8
Affected Vendor
opengeos
View all reports →Affected Software
streamlit-geospatial
Vulnerable Versions:
< c4f81d9616d40c60584e36abb15300853a66e489
Timeline
Official Publish:
July 26th, 2024
Last Modified:
August 2nd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H