CVE-2023-27494

Streamlit, software for turning data scripts into web applications, had a cross-site scripting (XSS) vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit app(s) were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to a Streamlit app. The attacker could then trick the user into visiting the malicious URL and, if successful, the server would render the malicious javascript payload as-is, leading to XSS. Version 0.81.0 contains a patch for this vulnerability.

• CWE-79

• https://github.com/streamlit/streamlit/commit/afcf880c60e5d7538936cc2d9721b9e1bc02b075Patch
• https://github.com/streamlit/streamlit/security/advisories/GHSA-9c6g-qpgj-rvxwVendor Advisory
• https://github.com/streamlit/streamlit/commit/afcf880c60e5d7538936cc2d9721b9e1bc02b075Patch
• https://github.com/streamlit/streamlit/security/advisories/GHSA-9c6g-qpgj-rvxwVendor Advisory

Published

Mar 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27489Kiwi TCMS is an open source test management system for both …5.4
• CVE-2023-2749Download Center fails to properly validate the file path sub…7.5
• CVE-2023-27490NextAuth.js is an open source authentication solution for Ne…8.8
• CVE-2023-27491Envoy is an open source edge and service proxy designed for …9.1
• CVE-2023-27492Envoy is an open source edge and service proxy designed for …6.5
• CVE-2023-27493Envoy is an open source edge and service proxy designed for …9.1
• CVE-2023-27495@fastify/csrf-protection is a plugin which helps protect Fas…6.5
• CVE-2023-27496Envoy is an open source edge and service proxy designed for …7.5
• CVE-2023-27497Due to missing authentication and input sanitization of code…9.8
• CVE-2023-27498SAP Host Agent (SAPOSCOL) - version 7.22, allows an unauthen…7.2
• CVE-2023-27499SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7…6.1
• CVE-2023-2750Improper Neutralization of Special Elements used in an SQL C…9.8