CVE-2026-10804

LOW EPSS 0.3%

Published Jun 4, 20263w ago · Modified Jun 17, 20261w ago

1.1 CVSS 4.0

Low

Published Jun 4, 2026 3w ago

Last Modified Jun 17, 2026 1w ago

Description

A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

CVSS Details

Base Score

1.1

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Local

Attack Complexity High

Privileges Required Low

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

0.3% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 2

CWE-327

CWE-328

Affected Products 1

Vendor	Product	Version	Range
snowflake	streamlit	*	≤1.53.0

References 7

github.com https://github.com/streamlit/streamlit/

Product
github.com https://github.com/streamlit/streamlit/issues/14622

Issue TrackingMitigationPatch
github.com https://github.com/streamlit/streamlit/pull/14635

Issue TrackingPatch
vuldb.com https://vuldb.com/cve/CVE-2026-10804

Third Party AdvisoryVDB Entry
vuldb.com https://vuldb.com/submit/831508

Third Party AdvisoryVDB Entry
vuldb.com https://vuldb.com/vuln/368253

Third Party AdvisoryVDB Entry
vuldb.com https://vuldb.com/vuln/368253/cti

Permissions RequiredVDB Entry

Remediation

github.com https://github.com/streamlit/streamlit/issues/14622

Issue TrackingMitigationPatch
github.com https://github.com/streamlit/streamlit/pull/14635

Issue TrackingPatch