Vulnerability-Lookup

CVE-2026-10804 (GCVE-0-2026-10804)

Vulnerability from cvelistv5 – Published: 2026-06-04 12:00 – Updated: 2026-06-04 14:23

Title

Streamlit Palette hashing.py weak hash

Summary

A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

Severity

2 (Low)


                        
                          CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

3.6 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C

3.6 (Low)


                        
                          CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-328 - Use of Weak Hash
CWE-327 - Risky Cryptographic Algorithm

Assigner

VulDB

References

7 references

URL	Tags
https://vuldb.com/vuln/368253	vdb-entry
https://vuldb.com/vuln/368253/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-10804	third-party-advisory
https://vuldb.com/submit/831508	third-party-advisory
https://github.com/streamlit/streamlit/issues/14622	exploitissue-tracking
https://github.com/streamlit/streamlit/pull/14635	issue-trackingpatch
https://github.com/streamlit/streamlit/	product

Impacted products

1 product

Vendor	Product	Version
n/a	Streamlit	Affected: 1.0 Affected: 1.1 Affected: 1.2 Affected: 1.3 Affected: 1.4 Affected: 1.5 Affected: 1.6 Affected: 1.7 Affected: 1.8 Affected: 1.9 Affected: 1.10 Affected: 1.11 Affected: 1.12 Affected: 1.13 Affected: 1.14 Affected: 1.15 Affected: 1.16 Affected: 1.17 Affected: 1.18 Affected: 1.19 Affected: 1.20 Affected: 1.21 Affected: 1.22 Affected: 1.23 Affected: 1.24 Affected: 1.25 Affected: 1.26 Affected: 1.27 Affected: 1.28 Affected: 1.29 Affected: 1.30 Affected: 1.31 Affected: 1.32 Affected: 1.33 Affected: 1.34 Affected: 1.35 Affected: 1.36 Affected: 1.37 Affected: 1.38 Affected: 1.39 Affected: 1.40 Affected: 1.41 Affected: 1.42 Affected: 1.43 Affected: 1.44 Affected: 1.45 Affected: 1.46 Affected: 1.47 Affected: 1.48 Affected: 1.49 Affected: 1.50 Affected: 1.51 Affected: 1.52 Affected: 1.53.0 cpe:2.3:a:streamlit:streamlit::::::::

Credits

Dem0 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-10804",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T14:22:17.927620Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-04T14:23:02.735Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:streamlit:streamlit:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Palette Handler"
          ],
          "product": "Streamlit",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "1.5"
            },
            {
              "status": "affected",
              "version": "1.6"
            },
            {
              "status": "affected",
              "version": "1.7"
            },
            {
              "status": "affected",
              "version": "1.8"
            },
            {
              "status": "affected",
              "version": "1.9"
            },
            {
              "status": "affected",
              "version": "1.10"
            },
            {
              "status": "affected",
              "version": "1.11"
            },
            {
              "status": "affected",
              "version": "1.12"
            },
            {
              "status": "affected",
              "version": "1.13"
            },
            {
              "status": "affected",
              "version": "1.14"
            },
            {
              "status": "affected",
              "version": "1.15"
            },
            {
              "status": "affected",
              "version": "1.16"
            },
            {
              "status": "affected",
              "version": "1.17"
            },
            {
              "status": "affected",
              "version": "1.18"
            },
            {
              "status": "affected",
              "version": "1.19"
            },
            {
              "status": "affected",
              "version": "1.20"
            },
            {
              "status": "affected",
              "version": "1.21"
            },
            {
              "status": "affected",
              "version": "1.22"
            },
            {
              "status": "affected",
              "version": "1.23"
            },
            {
              "status": "affected",
              "version": "1.24"
            },
            {
              "status": "affected",
              "version": "1.25"
            },
            {
              "status": "affected",
              "version": "1.26"
            },
            {
              "status": "affected",
              "version": "1.27"
            },
            {
              "status": "affected",
              "version": "1.28"
            },
            {
              "status": "affected",
              "version": "1.29"
            },
            {
              "status": "affected",
              "version": "1.30"
            },
            {
              "status": "affected",
              "version": "1.31"
            },
            {
              "status": "affected",
              "version": "1.32"
            },
            {
              "status": "affected",
              "version": "1.33"
            },
            {
              "status": "affected",
              "version": "1.34"
            },
            {
              "status": "affected",
              "version": "1.35"
            },
            {
              "status": "affected",
              "version": "1.36"
            },
            {
              "status": "affected",
              "version": "1.37"
            },
            {
              "status": "affected",
              "version": "1.38"
            },
            {
              "status": "affected",
              "version": "1.39"
            },
            {
              "status": "affected",
              "version": "1.40"
            },
            {
              "status": "affected",
              "version": "1.41"
            },
            {
              "status": "affected",
              "version": "1.42"
            },
            {
              "status": "affected",
              "version": "1.43"
            },
            {
              "status": "affected",
              "version": "1.44"
            },
            {
              "status": "affected",
              "version": "1.45"
            },
            {
              "status": "affected",
              "version": "1.46"
            },
            {
              "status": "affected",
              "version": "1.47"
            },
            {
              "status": "affected",
              "version": "1.48"
            },
            {
              "status": "affected",
              "version": "1.49"
            },
            {
              "status": "affected",
              "version": "1.50"
            },
            {
              "status": "affected",
              "version": "1.51"
            },
            {
              "status": "affected",
              "version": "1.52"
            },
            {
              "status": "affected",
              "version": "1.53.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Dem0 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 2,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 2.4,
            "vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-328",
              "description": "Use of Weak Hash",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-327",
              "description": "Risky Cryptographic Algorithm",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T12:00:14.916Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-368253 | Streamlit Palette hashing.py weak hash",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/368253"
        },
        {
          "name": "VDB-368253 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/368253/cti"
        },
        {
          "name": "CVE-2026-10804 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-10804"
        },
        {
          "name": "Submit #831508 | streamlit 1.53.0 hash collision",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/831508"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/streamlit/streamlit/issues/14622"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/streamlit/streamlit/pull/14635"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/streamlit/streamlit/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-04T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-06-04T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-06-04T07:15:01.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Streamlit Palette hashing.py weak hash"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-10804",
    "datePublished": "2026-06-04T12:00:14.916Z",
    "dateReserved": "2026-06-04T05:09:57.527Z",
    "dateUpdated": "2026-06-04T14:23:02.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-10804",
      "date": "2026-07-26",
      "epss": "0.00083",
      "percentile": "0.00319"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-10804\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2026-06-04T12:16:24.620\",\"lastModified\":\"2026-07-22T20:10:00.127\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad ha sido encontrada en Streamlit hasta la versi\u00f3n 1.53.0. Afecta a una funci\u00f3n desconocida en la biblioteca lib/streamlit/runtime/caching/hashing.py del componente Gestor de Paletas. Dicha manipulaci\u00f3n conduce al uso de un hash d\u00e9bil. Se requiere acceso local para llevar a cabo este ataque. El ataque requiere un alto nivel de complejidad. La explotabilidad se considera dif\u00edcil. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. La solicitud de extracci\u00f3n para solucionar este problema espera ser aceptada.\"}],\"affected\":[{\"source\":\"cna@vuldb.com\",\"affectedData\":[{\"vendor\":\"n/a\",\"product\":\"Streamlit\",\"cpes\":[\"cpe:2.3:a:streamlit:streamlit:*:*:*:*:*:*:*:*\"],\"modules\":[\"Palette Handler\"],\"versions\":[{\"version\":\"1.0\",\"status\":\"affected\"},{\"version\":\"1.1\",\"status\":\"affected\"},{\"version\":\"1.2\",\"status\":\"affected\"},{\"version\":\"1.3\",\"status\":\"affected\"},{\"version\":\"1.4\",\"status\":\"affected\"},{\"version\":\"1.5\",\"status\":\"affected\"},{\"version\":\"1.6\",\"status\":\"affected\"},{\"version\":\"1.7\",\"status\":\"affected\"},{\"version\":\"1.8\",\"status\":\"affected\"},{\"version\":\"1.9\",\"status\":\"affected\"},{\"version\":\"1.10\",\"status\":\"affected\"},{\"version\":\"1.11\",\"status\":\"affected\"},{\"version\":\"1.12\",\"status\":\"affected\"},{\"version\":\"1.13\",\"status\":\"affected\"},{\"version\":\"1.14\",\"status\":\"affected\"},{\"version\":\"1.15\",\"status\":\"affected\"},{\"version\":\"1.16\",\"status\":\"affected\"},{\"version\":\"1.17\",\"status\":\"affected\"},{\"version\":\"1.18\",\"status\":\"affected\"},{\"version\":\"1.19\",\"status\":\"affected\"},{\"version\":\"1.20\",\"status\":\"affected\"},{\"version\":\"1.21\",\"status\":\"affected\"},{\"version\":\"1.22\",\"status\":\"affected\"},{\"version\":\"1.23\",\"status\":\"affected\"},{\"version\":\"1.24\",\"status\":\"affected\"},{\"version\":\"1.25\",\"status\":\"affected\"},{\"version\":\"1.26\",\"status\":\"affected\"},{\"version\":\"1.27\",\"status\":\"affected\"},{\"version\":\"1.28\",\"status\":\"affected\"},{\"version\":\"1.29\",\"status\":\"affected\"},{\"version\":\"1.30\",\"status\":\"affected\"},{\"version\":\"1.31\",\"status\":\"affected\"},{\"version\":\"1.32\",\"status\":\"affected\"},{\"version\":\"1.33\",\"status\":\"affected\"},{\"version\":\"1.34\",\"status\":\"affected\"},{\"version\":\"1.35\",\"status\":\"affected\"},{\"version\":\"1.36\",\"status\":\"affected\"},{\"version\":\"1.37\",\"status\":\"affected\"},{\"version\":\"1.38\",\"status\":\"affected\"},{\"version\":\"1.39\",\"status\":\"affected\"},{\"version\":\"1.40\",\"status\":\"affected\"},{\"version\":\"1.41\",\"status\":\"affected\"},{\"version\":\"1.42\",\"status\":\"affected\"},{\"version\":\"1.43\",\"status\":\"affected\"},{\"version\":\"1.44\",\"status\":\"affected\"},{\"version\":\"1.45\",\"status\":\"affected\"},{\"version\":\"1.46\",\"status\":\"affected\"},{\"version\":\"1.47\",\"status\":\"affected\"},{\"version\":\"1.48\",\"status\":\"affected\"},{\"version\":\"1.49\",\"status\":\"affected\"},{\"version\":\"1.50\",\"status\":\"affected\"},{\"version\":\"1.51\",\"status\":\"affected\"},{\"version\":\"1.52\",\"status\":\"affected\"},{\"version\":\"1.53.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":1.1,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L\",\"baseScore\":3.6,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.0,\"impactScore\":2.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:H/Au:S/C:N/I:P/A:P\",\"baseScore\":2.4,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"HIGH\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":1.5,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-04T14:22:17.927620Z\",\"id\":\"CVE-2026-10804\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-327\"},{\"lang\":\"en\",\"value\":\"CWE-328\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:snowflake:streamlit:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.53.0\",\"matchCriteriaId\":\"6345EBCC-07CA-4C5A-9A2A-EE663D607D2A\"}]}]}],\"references\":[{\"url\":\"https://github.com/streamlit/streamlit/\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/streamlit/streamlit/issues/14622\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Issue Tracking\",\"Mitigation\",\"Patch\"]},{\"url\":\"https://github.com/streamlit/streamlit/pull/14635\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://vuldb.com/cve/CVE-2026-10804\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://vuldb.com/submit/831508\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://vuldb.com/vuln/368253\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://vuldb.com/vuln/368253/cti\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Permissions Required\",\"VDB Entry\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-04T08:19:12+00:00",
      "cve": "CVE-2026-10804",
      "id": "CVE-2026-10804",
      "initial_release_date": "2026-06-04T12:00:14.916000+00:00",
      "product_status:known_affected": "5",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "streamlit: Streamlit: Weak hash usage leading to low integrity and availability impact",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10804.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-10804\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-04T14:22:17.927620Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-04T14:22:57.796Z\"}}], \"cna\": {\"title\": \"Streamlit Palette hashing.py weak hash\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Dem0 (VulDB User)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"VulDB CNA Team\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 2, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 3.6, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 3.6, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 2.4, \"vectorString\": \"AV:L/AC:H/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:C\"}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:streamlit:streamlit:*:*:*:*:*:*:*:*\"], \"vendor\": \"n/a\", \"modules\": [\"Palette Handler\"], \"product\": \"Streamlit\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0\"}, {\"status\": \"affected\", \"version\": \"1.1\"}, {\"status\": \"affected\", \"version\": \"1.2\"}, {\"status\": \"affected\", \"version\": \"1.3\"}, {\"status\": \"affected\", \"version\": \"1.4\"}, {\"status\": \"affected\", \"version\": \"1.5\"}, {\"status\": \"affected\", \"version\": \"1.6\"}, {\"status\": \"affected\", \"version\": \"1.7\"}, {\"status\": \"affected\", \"version\": \"1.8\"}, {\"status\": \"affected\", \"version\": \"1.9\"}, {\"status\": \"affected\", \"version\": \"1.10\"}, {\"status\": \"affected\", \"version\": \"1.11\"}, {\"status\": \"affected\", \"version\": \"1.12\"}, {\"status\": \"affected\", \"version\": \"1.13\"}, {\"status\": \"affected\", \"version\": \"1.14\"}, {\"status\": \"affected\", \"version\": \"1.15\"}, {\"status\": \"affected\", \"version\": \"1.16\"}, {\"status\": \"affected\", \"version\": \"1.17\"}, {\"status\": \"affected\", \"version\": \"1.18\"}, {\"status\": \"affected\", \"version\": \"1.19\"}, {\"status\": \"affected\", \"version\": \"1.20\"}, {\"status\": \"affected\", \"version\": \"1.21\"}, {\"status\": \"affected\", \"version\": \"1.22\"}, {\"status\": \"affected\", \"version\": \"1.23\"}, {\"status\": \"affected\", \"version\": \"1.24\"}, {\"status\": \"affected\", \"version\": \"1.25\"}, {\"status\": \"affected\", \"version\": \"1.26\"}, {\"status\": \"affected\", \"version\": \"1.27\"}, {\"status\": \"affected\", \"version\": \"1.28\"}, {\"status\": \"affected\", \"version\": \"1.29\"}, {\"status\": \"affected\", \"version\": \"1.30\"}, {\"status\": \"affected\", \"version\": \"1.31\"}, {\"status\": \"affected\", \"version\": \"1.32\"}, {\"status\": \"affected\", \"version\": \"1.33\"}, {\"status\": \"affected\", \"version\": \"1.34\"}, {\"status\": \"affected\", \"version\": \"1.35\"}, {\"status\": \"affected\", \"version\": \"1.36\"}, {\"status\": \"affected\", \"version\": \"1.37\"}, {\"status\": \"affected\", \"version\": \"1.38\"}, {\"status\": \"affected\", \"version\": \"1.39\"}, {\"status\": \"affected\", \"version\": \"1.40\"}, {\"status\": \"affected\", \"version\": \"1.41\"}, {\"status\": \"affected\", \"version\": \"1.42\"}, {\"status\": \"affected\", \"version\": \"1.43\"}, {\"status\": \"affected\", \"version\": \"1.44\"}, {\"status\": \"affected\", \"version\": \"1.45\"}, {\"status\": \"affected\", \"version\": \"1.46\"}, {\"status\": \"affected\", \"version\": \"1.47\"}, {\"status\": \"affected\", \"version\": \"1.48\"}, {\"status\": \"affected\", \"version\": \"1.49\"}, {\"status\": \"affected\", \"version\": \"1.50\"}, {\"status\": \"affected\", \"version\": \"1.51\"}, {\"status\": \"affected\", \"version\": \"1.52\"}, {\"status\": \"affected\", \"version\": \"1.53.0\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-04T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2026-06-04T02:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2026-06-04T07:15:01.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/vuln/368253\", \"name\": \"VDB-368253 | Streamlit Palette hashing.py weak hash\", \"tags\": [\"vdb-entry\"]}, {\"url\": \"https://vuldb.com/vuln/368253/cti\", \"name\": \"VDB-368253 | CTI Indicators (IOB, IOC, TTP, IOA)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/cve/CVE-2026-10804\", \"name\": \"CVE-2026-10804 | CVE Analysis and Report\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://vuldb.com/submit/831508\", \"name\": \"Submit #831508 | streamlit 1.53.0 hash collision\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://github.com/streamlit/streamlit/issues/14622\", \"tags\": [\"exploit\", \"issue-tracking\"]}, {\"url\": \"https://github.com/streamlit/streamlit/pull/14635\", \"tags\": [\"issue-tracking\", \"patch\"]}, {\"url\": \"https://github.com/streamlit/streamlit/\", \"tags\": [\"product\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-328\", \"description\": \"Use of Weak Hash\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-327\", \"description\": \"Risky Cryptographic Algorithm\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2026-06-04T12:00:14.916Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-10804\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-04T14:23:02.735Z\", \"dateReserved\": \"2026-06-04T05:09:57.527Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2026-06-04T12:00:14.916Z\", \"assignerShortName\": \"VulDB\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-10804

Vulnerability from fkie_nvd - Published: 2026-06-04 12:16 - Updated: 2026-07-22 20:10

Severity

3.6 (Low) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

References

URL	Tags
cna@vuldb.com	https://github.com/streamlit/streamlit/	Product
cna@vuldb.com	https://github.com/streamlit/streamlit/issues/14622	Issue Tracking, Mitigation, Patch
cna@vuldb.com	https://github.com/streamlit/streamlit/pull/14635	Issue Tracking, Patch
cna@vuldb.com	https://vuldb.com/cve/CVE-2026-10804	Third Party Advisory, VDB Entry
cna@vuldb.com	https://vuldb.com/submit/831508	Third Party Advisory, VDB Entry
cna@vuldb.com	https://vuldb.com/vuln/368253	Third Party Advisory, VDB Entry
cna@vuldb.com	https://vuldb.com/vuln/368253/cti	Permissions Required, VDB Entry

Impacted products

	Vendor	Product	Version
	snowflake	streamlit	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:streamlit:streamlit:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Palette Handler"
          ],
          "product": "Streamlit",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "1.5"
            },
            {
              "status": "affected",
              "version": "1.6"
            },
            {
              "status": "affected",
              "version": "1.7"
            },
            {
              "status": "affected",
              "version": "1.8"
            },
            {
              "status": "affected",
              "version": "1.9"
            },
            {
              "status": "affected",
              "version": "1.10"
            },
            {
              "status": "affected",
              "version": "1.11"
            },
            {
              "status": "affected",
              "version": "1.12"
            },
            {
              "status": "affected",
              "version": "1.13"
            },
            {
              "status": "affected",
              "version": "1.14"
            },
            {
              "status": "affected",
              "version": "1.15"
            },
            {
              "status": "affected",
              "version": "1.16"
            },
            {
              "status": "affected",
              "version": "1.17"
            },
            {
              "status": "affected",
              "version": "1.18"
            },
            {
              "status": "affected",
              "version": "1.19"
            },
            {
              "status": "affected",
              "version": "1.20"
            },
            {
              "status": "affected",
              "version": "1.21"
            },
            {
              "status": "affected",
              "version": "1.22"
            },
            {
              "status": "affected",
              "version": "1.23"
            },
            {
              "status": "affected",
              "version": "1.24"
            },
            {
              "status": "affected",
              "version": "1.25"
            },
            {
              "status": "affected",
              "version": "1.26"
            },
            {
              "status": "affected",
              "version": "1.27"
            },
            {
              "status": "affected",
              "version": "1.28"
            },
            {
              "status": "affected",
              "version": "1.29"
            },
            {
              "status": "affected",
              "version": "1.30"
            },
            {
              "status": "affected",
              "version": "1.31"
            },
            {
              "status": "affected",
              "version": "1.32"
            },
            {
              "status": "affected",
              "version": "1.33"
            },
            {
              "status": "affected",
              "version": "1.34"
            },
            {
              "status": "affected",
              "version": "1.35"
            },
            {
              "status": "affected",
              "version": "1.36"
            },
            {
              "status": "affected",
              "version": "1.37"
            },
            {
              "status": "affected",
              "version": "1.38"
            },
            {
              "status": "affected",
              "version": "1.39"
            },
            {
              "status": "affected",
              "version": "1.40"
            },
            {
              "status": "affected",
              "version": "1.41"
            },
            {
              "status": "affected",
              "version": "1.42"
            },
            {
              "status": "affected",
              "version": "1.43"
            },
            {
              "status": "affected",
              "version": "1.44"
            },
            {
              "status": "affected",
              "version": "1.45"
            },
            {
              "status": "affected",
              "version": "1.46"
            },
            {
              "status": "affected",
              "version": "1.47"
            },
            {
              "status": "affected",
              "version": "1.48"
            },
            {
              "status": "affected",
              "version": "1.49"
            },
            {
              "status": "affected",
              "version": "1.50"
            },
            {
              "status": "affected",
              "version": "1.51"
            },
            {
              "status": "affected",
              "version": "1.52"
            },
            {
              "status": "affected",
              "version": "1.53.0"
            }
          ]
        }
      ],
      "source": "cna@vuldb.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:snowflake:streamlit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6345EBCC-07CA-4C5A-9A2A-EE663D607D2A",
              "versionEndIncluding": "1.53.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad ha sido encontrada en Streamlit hasta la versi\u00f3n 1.53.0. Afecta a una funci\u00f3n desconocida en la biblioteca lib/streamlit/runtime/caching/hashing.py del componente Gestor de Paletas. Dicha manipulaci\u00f3n conduce al uso de un hash d\u00e9bil. Se requiere acceso local para llevar a cabo este ataque. El ataque requiere un alto nivel de complejidad. La explotabilidad se considera dif\u00edcil. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. La solicitud de extracci\u00f3n para solucionar este problema espera ser aceptada."
    }
  ],
  "id": "CVE-2026-10804",
  "lastModified": "2026-07-22T20:10:00.127",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "LOCAL",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 2.4,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 3.6,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 2.5,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 1.1,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-10804",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-04T14:22:17.927620Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-04T12:16:24.620",
  "references": [
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/streamlit/streamlit/"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Issue Tracking",
        "Mitigation",
        "Patch"
      ],
      "url": "https://github.com/streamlit/streamlit/issues/14622"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/streamlit/streamlit/pull/14635"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://vuldb.com/cve/CVE-2026-10804"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://vuldb.com/submit/831508"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://vuldb.com/vuln/368253"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Permissions Required",
        "VDB Entry"
      ],
      "url": "https://vuldb.com/vuln/368253/cti"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-327"
        },
        {
          "lang": "en",
          "value": "CWE-328"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    }
  ]
}

GHSA-VQWP-45WM-R9R5

Vulnerability from github – Published: 2026-06-04 12:30 – Updated: 2026-07-15 21:49

Summary

Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission

Details

Severity

3.6 (Low)


                  
                    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

1.1 (Low)


                  
                    CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "streamlit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.53.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-10804"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-327"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-15T21:49:13Z",
    "nvd_published_at": "2026-06-04T12:16:24Z",
    "severity": "LOW"
  },
  "details": "A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.",
  "id": "GHSA-vqwp-45wm-r9r5",
  "modified": "2026-07-15T21:49:13Z",
  "published": "2026-06-04T12:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10804"
    },
    {
      "type": "WEB",
      "url": "https://github.com/streamlit/streamlit/issues/14622"
    },
    {
      "type": "WEB",
      "url": "https://github.com/streamlit/streamlit/pull/14635"
    },
    {
      "type": "WEB",
      "url": "https://github.com/streamlit/streamlit/pull/15397"
    },
    {
      "type": "WEB",
      "url": "https://github.com/streamlit/streamlit/commit/fec0f584dae9261abed16cad35b32922104bb933"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/streamlit/PYSEC-2026-212.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/streamlit/streamlit"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-10804"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/831508"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/368253"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/368253/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission"
}

PYSEC-2026-212

Vulnerability from pysec - Published: 2026-06-04 12:16 - Updated: 2026-06-15 19:36

Details

Severity

4.7 (Medium)


                  
                    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Impacted products

Name	purl
streamlit	pkg:pypi/streamlit

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "streamlit",
        "purl": "pkg:pypi/streamlit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.53.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1",
        "0.11.0",
        "0.12.2",
        "0.12.3",
        "0.12.4",
        "0.13.0",
        "0.13.1",
        "0.13.3",
        "0.13.5",
        "0.14.2",
        "0.15.0",
        "0.15.1",
        "0.15.2",
        "0.15.3",
        "0.15.4",
        "0.15.5",
        "0.15.6",
        "0.16.0",
        "0.16.1",
        "0.16.2",
        "0.16.3",
        "0.17.0",
        "0.17.1",
        "0.17.2",
        "0.18.0",
        "0.18.1",
        "0.19.0",
        "0.19.1",
        "0.2",
        "0.20.0",
        "0.21.0",
        "0.22.0",
        "0.22.1",
        "0.22.2",
        "0.23.0",
        "0.24.0",
        "0.24.1",
        "0.24.2",
        "0.24.3",
        "0.25.0",
        "0.26.0",
        "0.26.1",
        "0.27.0",
        "0.28.0",
        "0.29.0",
        "0.3",
        "0.30.0",
        "0.31.0",
        "0.32.0",
        "0.33.0",
        "0.34.0",
        "0.35.0",
        "0.36.0",
        "0.37.0",
        "0.4",
        "0.40.0",
        "0.40.1",
        "0.41.0",
        "0.42.0",
        "0.43.0",
        "0.43.1",
        "0.43.2",
        "0.44.0",
        "0.45.0",
        "0.46.0",
        "0.47.0",
        "0.47.1",
        "0.47.2",
        "0.47.3",
        "0.47.4",
        "0.48.0",
        "0.48.1",
        "0.49.0",
        "0.5",
        "0.50.0",
        "0.50.1",
        "0.50.2",
        "0.51.0",
        "0.52.0",
        "0.52.1",
        "0.52.2",
        "0.53.0",
        "0.54.0",
        "0.55.0",
        "0.55.2",
        "0.56.0",
        "0.57.0",
        "0.57.1",
        "0.57.2",
        "0.57.3",
        "0.58.0",
        "0.59.0",
        "0.6",
        "0.60.0",
        "0.61.0",
        "0.62.0",
        "0.62.1",
        "0.63.0",
        "0.63.1",
        "0.64.0",
        "0.65.0",
        "0.65.1",
        "0.65.2",
        "0.66.0",
        "0.67.0",
        "0.67.1",
        "0.68.0",
        "0.68.1",
        "0.69.0",
        "0.69.1",
        "0.69.2",
        "0.7",
        "0.70.0",
        "0.71.0",
        "0.72.0",
        "0.73.0",
        "0.73.1",
        "0.74.0",
        "0.74.1",
        "0.75.0",
        "0.76.0",
        "0.77.0",
        "0.78.0",
        "0.79.0",
        "0.8",
        "0.8.2",
        "0.80.0",
        "0.81.0",
        "0.81.1",
        "0.82.0",
        "0.83.0",
        "0.84.0",
        "0.84.1",
        "0.84.2",
        "0.85.0",
        "0.85.1",
        "0.86.0",
        "0.87.0",
        "0.88.0",
        "0.89.0",
        "0.9.0",
        "1.0.0",
        "1.1.0",
        "1.10.0",
        "1.10.0rc1",
        "1.10.0rc2",
        "1.11.0",
        "1.11.0rc1",
        "1.11.1",
        "1.11.1rc1",
        "1.12.0",
        "1.12.0rc1",
        "1.12.0rc2",
        "1.12.1",
        "1.12.1rc1",
        "1.12.2",
        "1.12.2rc1",
        "1.12.2rc2",
        "1.13.0",
        "1.13.0rc1",
        "1.13.0rc2",
        "1.14.0",
        "1.14.0rc1",
        "1.14.1",
        "1.14.1rc1",
        "1.15.0",
        "1.15.1",
        "1.15.2",
        "1.15.2rc1",
        "1.16.0",
        "1.17.0",
        "1.18.0",
        "1.18.1",
        "1.18.1rc1",
        "1.19.0",
        "1.2.0",
        "1.20.0",
        "1.21.0",
        "1.22.0",
        "1.23.0",
        "1.23.1",
        "1.24.0",
        "1.24.1",
        "1.25.0",
        "1.26.0",
        "1.26.1",
        "1.27.0",
        "1.27.1",
        "1.27.2",
        "1.28.0",
        "1.28.1",
        "1.28.2",
        "1.29.0",
        "1.3.0",
        "1.3.1",
        "1.30.0",
        "1.31.0",
        "1.31.1",
        "1.32.0",
        "1.32.1",
        "1.32.2",
        "1.32.2rc1",
        "1.33.0",
        "1.34.0",
        "1.35.0",
        "1.36.0",
        "1.37.0",
        "1.37.1",
        "1.38.0",
        "1.39.0",
        "1.39.1",
        "1.4.0",
        "1.40.0",
        "1.40.1",
        "1.40.2",
        "1.41.0",
        "1.41.1",
        "1.42.0",
        "1.42.1",
        "1.42.2",
        "1.43.0",
        "1.43.1",
        "1.43.2",
        "1.44.0",
        "1.44.1",
        "1.45.0",
        "1.45.1",
        "1.46.0",
        "1.46.1",
        "1.47.0",
        "1.47.1",
        "1.48.0",
        "1.48.1",
        "1.49.0",
        "1.49.1",
        "1.5.0",
        "1.5.1",
        "1.50.0",
        "1.51.0",
        "1.52.0",
        "1.52.1",
        "1.52.2",
        "1.53.0",
        "1.6.0",
        "1.6.0rc3",
        "1.6.0rc4",
        "1.7.0",
        "1.8.0",
        "1.8.0rc1",
        "1.8.1",
        "1.8.1rc1",
        "1.9.0",
        "1.9.0rc1",
        "1.9.1",
        "1.9.1rc1",
        "1.9.1rc2",
        "1.9.2",
        "1.9.2rc1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-10804",
    "GHSA-vqwp-45wm-r9r5"
  ],
  "details": "A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.",
  "id": "PYSEC-2026-212",
  "modified": "2026-06-15T19:36:32.619147Z",
  "published": "2026-06-04T12:16:24.620Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/streamlit/streamlit/"
    },
    {
      "type": "ADVISORY",
      "url": "https://vuldb.com/cve/CVE-2026-10804"
    },
    {
      "type": "ADVISORY",
      "url": "https://vuldb.com/submit/831508"
    },
    {
      "type": "ADVISORY",
      "url": "https://vuldb.com/vuln/368253"
    },
    {
      "type": "REPORT",
      "url": "https://vuldb.com/vuln/368253/cti"
    },
    {
      "type": "FIX",
      "url": "https://github.com/streamlit/streamlit/issues/14622"
    },
    {
      "type": "FIX",
      "url": "https://github.com/streamlit/streamlit/pull/14635"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-vqwp-45wm-r9r5"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-10804 (GCVE-0-2026-10804)

FKIE_CVE-2026-10804

GHSA-VQWP-45WM-R9R5

PYSEC-2026-212

Tags

Sightings

Nomenclature