Read the docs
TI-2023-12222 Aliases CVE-2023-27494GHSA-9c6g-qpgj-rvxw

Streamlit Cross-site Scripting vulnerability

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Streamlit, software for turning data scripts into web applications, had a cross-site scripting (XSS) vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit app(s) were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to a Streamlit app. The attacker could then trick the user into visiting the malicious URL and, if successful, the server would render the malicious javascript payload as-is, leading to XSS. Version 0.81.0 contains a patch for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00407 35th percentileScored 2026-11-07
Fix Fixed streamlit (streamlit): 0.81.0streamlit (PyPI): 0.81.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Snowflakestreamlit0.63.0 to before 0.81.00.81.0Patch availableCNA
—streamlit (PyPI)0.63.0 to before 0.81.00.81.0Patch availableGHSA-9c6g-qpgj-rvxw
  • streamlit VendorSnowflake Affected 0.63.0 to before 0.81.0 Fixed in 0.81.0 Patch available CNA
  • streamlit (PyPI) Vendor— Affected 0.63.0 to before 0.81.0 Fixed in 0.81.0 Patch available GHSA-9c6g-qpgj-rvxw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:snowflake:streamlit:*:*:*:*:*:*:*:*0.63.0 to before 0.81.0VulnerableSnowflake
  • cpe:2.3:a:snowflake:streamlit:*:*:*:*:*:*:*:* Versions 0.63.0 to before 0.81.0 Vulnerable ·Snowflake

Remediation

  • Fix · CNA streamlit (streamlit) Fixed in 0.81.0
  • Fix · GHSA-9c6g-qpgj-rvxw streamlit (PyPI) Fixed in 0.81.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-27494
  2. 2026-10-03 Alias added: GHSA-9c6g-qpgj-rvxw

References

Patch 1

Advisory 2

Other 2

  • TI-2026-09272 Streamlit Palette hashing.py weak hash CVSS 4.0LOW 2.0
  • TI-2022-16345 Streamlit directory traversal vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2024-28442 Streamlit Path Traversal Security Vulnerability on Windows CVSS 3.1MEDIUM 6.5
  • TI-2026-26062 Streamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure) CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences