GMS-2024-20: Minor fix to previous patch for CVE-2022-35918

January 12, 2024 (updated June 30, 2026)

The initial vulnerability identified in Streamlit apps using custom components, allowing for directory traversal attacks, was addressed in version 1.11.1. However, a minor issue persisted, which could still potentially expose certain files on the server file-system under specific conditions.

References

github.com/advisories/GHSA-8qw9-gf7w-42x5
github.com/advisories/GHSA-v4hr-4jpx-56gc
github.com/streamlit/streamlit/commit/bd0a8996c4c7ec55b9c6557e7b168b0c13a25b90
github.com/streamlit/streamlit/security/advisories/GHSA-8qw9-gf7w-42x5
www.cve.org/CVERecord?id=CVE-2022-35918

Code Behaviors & Features

Detect and mitigate GMS-2024-20 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →