CVE-2024-41119

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` variable on line 80 in `8_🏜️_Raster_Data_Visualization.py` takes user input, which is later used in the `eval()` function on line 86, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.

• CWE-20

• https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/8_%F0%9F%8F%9C%EF%B8%8F_Raster_Data_Visualization.py#L80Product
• https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/8_%F0%9F%8F%9C%EF%B8%8F_Raster_Data_Visualization.py#L86Product
• https://github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489Patch
• https://securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatial/Exploit, Third Party Advisory
• https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/8_%F0%9F%8F%9C%EF%B8%8F_Raster_Data_Visualization.py#L80Product
• https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/8_%F0%9F%8F%9C%EF%B8%8F_Raster_Data_Visualization.py#L86Product
• https://github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489Patch
• https://securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatial/Exploit, Third Party Advisory

Published

Jul 26, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41113streamlit-geospatial is a streamlit multipage app for geospa…9.8
• CVE-2024-41114streamlit-geospatial is a streamlit multipage app for geospa…9.8
• CVE-2024-41115streamlit-geospatial is a streamlit multipage app for geospa…9.8
• CVE-2024-41116streamlit-geospatial is a streamlit multipage app for geospa…9.8
• CVE-2024-41117streamlit-geospatial is a streamlit multipage app for geospa…9.8
• CVE-2024-41118streamlit-geospatial is a streamlit multipage app for geospa…9.8
• CVE-2024-4112A vulnerability classified as critical has been found in Ten…8.8
• CVE-2024-41120streamlit-geospatial is a streamlit multipage app for geospa…9.8
• CVE-2024-41121Woodpecker is a simple yet powerful CI/CD engine with great …8.8
• CVE-2024-41122Woodpecker is a simple yet powerful CI/CD engine with great …8.8
• CVE-2024-41123REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2…7.5
• CVE-2024-41124Puncia is the Official CLI utility for Subdomain Center & Ex…6.3