Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

taipy

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.3PyPIAmendedPublished

    Taipy has a Session Cookie without Secure and HTTPOnly flags

    CVE-2024-47833 · GHSA-r3jq-4r5c-j9hp

    Affected
    • PyPI taipy <= 3.1.1
    Fixed in
    4.0.0· Vendor fix available
    Issue
    Session cookie is without Secure and HTTPOnly flags. Details Please take a look at this part of code (PoC screenshot) or check code directly (provided in Occurrences section below) Occurrences: https://github.com/Avaiga/taipy/blob/develop/frontend/taipy-gui/src/components/Taipy/Navigate.tsx#L67 Proposed remediation: add Secure and HTTPOnly flags for cookies. It could be like this: document.cookie = tprh=${tprh};path=/;Secure;HttpOnly;; PoC Screenshot: Impact Secure: This flag indicates that the cookie should only be sent over secure HTTPS connections. Without this flag, the cookie will be sent over both HTTP and HTTPS connections, which could expose it to interception or tampering if the connection is not secure. HttpOnly: This flag prevents the cookie from being accessed by client-side JavaScript. It helps mitigate certain types of attacks, such as cross-site scripting (XSS), by preventing malicious scripts from accessing the cookie's value. References CWE-614: Sensitive…

    Recommended action: Upgrade to 4.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. UnratedPyPIAmendedPublished

    Taipy 3.1.1 affected by CVEs on flask-core and pymongo

    GHSA-pp84-v3mw-gg4w

    Affected
    • PyPI taipy <= 3.1.1
    Fixed in
    4.0.0· Vendor fix available
    Issue
    Indirect CVEs affect Taipy 3.1.1 Details Taipy 3.1.1 is affected by two existing CVEs: CVE-2024-1681 affects flask-core <4.0.1 and taipy 3.1.1 needs <=4.0.0 CVE-2024-5629 affects pymongo <4.6.3 and taipy 3.1.1 needs <=4.6.1 Please see References for further details. Patch please upgrade to the following versions: Fixed on patch versions: =3.1.2 and on major releases: =4.0.0 Impact pre-commit breaks when using dependency Taipy 3.1.1

    Recommended action: Upgrade to 4.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →