GMS-2024-20: Minor fix to previous patch for CVE-2022-35918

January 12, 2024 (updated June 30, 2026)

The initial vulnerability identified in Streamlit apps using custom components, allowing for directory traversal attacks, was addressed in version 1.11.1. However, a minor issue persisted, which could still potentially expose certain files on the server file-system under specific conditions.

References

github.com/advisories/GHSA-8qw9-gf7w-42x5
github.com/advisories/GHSA-v4hr-4jpx-56gc
github.com/streamlit/streamlit/commit/bd0a8996c4c7ec55b9c6557e7b168b0c13a25b90
github.com/streamlit/streamlit/security/advisories/GHSA-8qw9-gf7w-42x5
www.cve.org/CVERecord?id=CVE-2022-35918

Code Behaviors & Features

Detect and mitigate GMS-2024-20 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →