Path Traversal Vulnerability in Streamlit for Windows Users

CVE-2024-42474

What is CVE-2024-42474?

Streamlit, a data-driven application development framework for Python, is susceptible to a path traversal vulnerability when the static file sharing feature is activated on Windows. This flaw could allow attackers to exploit the system and potentially leak the password hash associated with the Windows user running Streamlit. To address this vulnerability, a patch was released on July 25, 2024, as part of version 1.37.0. It is crucial for users of hosted Streamlit applications on Windows to update to this version to mitigate any risks.

News Articles

The Stack

CVE-2024-42474

Hash and the data scientist: 3 Python frameworks exposed

A trio of popular Python frameworks – Gradio by Hugging Face, Jupyter Server, and Streamlit from Snowflake – vulnerable to NTLMv2 hash disclosure

References