CVE-2026-85183

CriticalCVSS 9.3

Published: 03/09/2026(UTC)Translated: 03/09/2026(UTC)NVD NIST

Summary

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.

Risk Assessment

The risk includes unauthorized access to the application and manipulation of its state by malicious web pages, potentially leading to data integrity breaches and session hijacking.

Recommendation

It is recommended to configure the socket.io server with CORS restricted to trusted domains and disable the credential flag, as well as implement CSRF protections for WebSocket connections.

Other vulnerabilities in Taipy

CVE-2026-48544High
A path traversal vulnerability in Taipy 4.1.1 (fixed in commit 129fd40) exists in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py. Unauthenticated attackers can bypass an incomplete path containment check using str.startswith() without a trailing path separator by sending crafted GET requests with path traversal segments, allowing unauthorized file access outside the intended library directory.

Original NVD description (English source)