admin/cve
1
0
Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2025-05-31 10:40:54 +00:00
Code Issues Packages Projects Releases Wiki Activity
cve/2024/CVE-2024-41117.md
0xMarcio 3428c6bdc6 Update CVE sources 2024-08-05 18:41
2024-08-05 18:41:32 +00:00

1015 B
Raw Blame History

CVE-2024-41117

Description

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the vis_params variable on line 115 in pages/10_🌍_Earth_Engine_Datasets.py takes user input, which is later used in the eval() function on line 126, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.

POC

Reference

Github

No PoCs found on GitHub currently.