Skip to content

chore(deps): update dependency streamlit to v1.54.0 [security]#3

Open
renovate[bot] wants to merge 3 commits into
devfrom
renovate/pypi-streamlit-vulnerability
Open

chore(deps): update dependency streamlit to v1.54.0 [security]#3
renovate[bot] wants to merge 3 commits into
devfrom
renovate/pypi-streamlit-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Mar 31, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
streamlit (changelog) ==1.32.0 → ==1.54.0 age adoption passing confidence

Path traveral in Streamlit on windows

CVE-2024-42474 / GHSA-rxff-vr5r-8cj5

More information

Details

1. Impacted Products

Streamilt Open Source versions before 1.37.0.

2. Introduction

Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows.

3. Path Traversal Vulnerability
3.1 Description

On May 12, 2024, Streamlit was informed via our bug bounty program about a path traversal vulnerability in the open source library. We fixed and merged a patch remediating the vulnerability on Jul 25, 2024. The issue was determined to be in the moderate severity range with a maximum CVSSv3 base score of 5.9

3.2 Scenarios and attack vector(s)

Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerability when the static file sharing feature is enabled. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit.

3.3 Resolution

The vulnerability has been fixed in all Streamlit versions released since Jul 25, 2024. We recommend all users upgrade to Version 1.37.0.

4. Contact

Please contact security@snowflake.com if you have any questions regarding this advisory. If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our Vulnerability Disclosure Policy.

Severity

  • CVSS Score: 6.0 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)

CVE-2026-33682 / GHSA-7p48-42j8-8846

More information

Details

Streamlit Open Source Security Advisory
1. Impacted Products

Streamlit Open Source versions prior to 1.54.0 running on Windows hosts.

2. Introduction

Snowflake Streamlit Open Source addressed a security vulnerability affecting Windows deployments related to improper handling and validation of filesystem paths within component request handling. The vulnerability was reported through the responsible disclosure program and has been remediated in Streamlit Open Source version 1.54.0. This issue affects only Streamlit deployments running on Windows operating systems.

3. Server-Side Request Forgery (SSRF) and NTLM Credential Exposure
3.1 Description

Streamlit was informed by a security researcher of an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. The vulnerability arises from improper validation of attacker-supplied filesystem paths. In certain code paths, including within the ComponentRequestHandler, filesystem paths are resolved using os.path.realpath() or Path.resolve() before sufficient validation occurs.

On Windows systems, supplying a malicious UNC path (e.g., \\attacker-controlled-host\share) can cause the Streamlit server to initiate outbound SMB connections over port 445. When Windows attempts to authenticate to the remote SMB server, NTLMv2 challenge-response credentials of the Windows user running the Streamlit process may be transmitted.

This behavior may allow an attacker to:

  • Perform NTLM relay attacks against other internal services
  • Identify internally reachable SMB hosts via timing analysis

Note: The issue is unauthenticated and does not require user interaction.

Captured NTLMv2 challenge-response hashes could be subjected to offline brute-force attacks in an attempt to recover the associated plaintext account password. While NTLMv2 incorporates a server challenge (nonce) that mitigates the use of precomputed rainbow tables, it does not prevent targeted offline password cracking against weak credentials.

Additionally, Microsoft has publicly discouraged the continued use of NTLM in favor of Kerberos and is actively progressing toward disabling NTLM by default in future Windows releases. Organizations that enforce NTLM restrictions, disable outbound NTLM authentication, require SMB signing, or block NTLM authentication to remote servers can reduce or eliminate the risk associated with credential relay or hash exposure scenarios.

As NTLM is considered legacy and increasingly deprecated (though not fully sunset), environments that have already implemented Microsoft-recommended NTLM hardening controls are less likely to be materially impacted. The overall risk therefore depends on the organization's authentication configuration and network security posture.

3.2 Scenarios and Attack Vectors

Streamlit applications running on Windows were vulnerable if component endpoints were exposed to untrusted networks. By appending an attacker-controlled SMB hostname to the URI path and issuing a GET request, the Streamlit server could be coerced into initiating an outbound SMB authentication attempt.

This could result in the leakage of NTLMv2 credential hashes for the Windows account running the Streamlit process.

3.3 Resolution
  • The vulnerability has been fixed in Streamlit Open Source version 1.54.0.
  • It is recommended that all Streamlit deployments on Windows be upgraded immediately to version 1.54.0 or later.
4. Contact

Please contact security@snowflake.com for any questions regarding this advisory.

If a security vulnerability is discovered in a Streamlit product or website, it should be reported through the responsible disclosure program. For more information, see the Vulnerability Disclosure Policy.

Severity

  • CVSS Score: 4.7 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

streamlit/streamlit (streamlit)

v1.54.0

Compare Source

What's Changed

Breaking Changes 🛠
New Features 🎉
Bug Fixes 🐛
Other Changes

New Contributors

Full Changelog: streamlit/streamlit@1.53.1...1.54.0

v1.53.1

Compare Source

Full Changelog: streamlit/streamlit@1.53.0...1.53.1

v1.53.0

Compare Source

What's Changed

Breaking Changes 🛠
New Features 🎉
Bug Fixes 🐛
Other Changes

New Contributors

Full Changelog: streamlit/streamlit@1.52.2...1.53.0

v1.52.2

Compare Source

Full Changelog: streamlit/streamlit@1.52.1...1.52.2

v1.52.1

Compare Source

Full Changelog: streamlit/streamlit@1.52.0...1.52.1

v1.52.0

Compare Source

What's Changed

Breaking Changes 🛠
New Features 🎉
Bug Fixes 🐛
Other Changes

New Contributors

Full Changelog: streamlit/streamlit@1.51.0...1.52.0

v1.51.0

Compare Source

What's Changed

New Features 🎉

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 31, 2026 •
edited
Loading

Greetings from the CI/CD pipeline! 🏗️

I've aggregated the results of the automated checks for this PR below.

🏷️ Release Preview

I've checked the 'Feedback' link for the new version. 💬

Current: 0.5.1a1 → Next: 0.5.1a2

Signal Value
Label (none)
PR title chore(deps): update dependency streamlit to v1.54.0 [security]
Bump alpha

⚠️ No conventional commit prefix — alpha-only bump.
Suggested: fix: update the thing or feat: update the thing

🚀 Release Channel Compatibility

Predicted next version: 0.5.1a2

Channel Status Note Current Constraint
Stable ⚪ Not in channel -
Testing ⚪ Not in channel -
Alpha ⚪ Not in channel -

📋 Repo Health

I've checked the repo's posture (aka architectural alignment). 🧘

⚠️ Some required files are missing.

Latest Version: 0.5.1a1

✅ difficult_dialogs/version.py — Version file
❌ README.md — README
❌ LICENSE — License file
✅ pyproject.toml — pyproject.toml
✅ CHANGELOG.md — Changelog
⚠️ requirements.txt — Requirements
✅ difficult_dialogs/version.py has valid version block markers

🔨 Build Tests

The blueprints match the build! 📐

✅ All versions pass

Python Build Install Tests
3.10 ✅ ✅ ✅
3.11 ✅ ✅ ✅
3.12 ✅ ✅ ✅
3.13 ✅ ✅ ✅
3.14 ✅ ✅ ✅

⚖️ License Check

Evaluating the impact of these changes on our licensing. 📈

✅ No license violations found (9 packages).

License distribution: 3× MIT, 2× Apache Software License, 1× Apache-2.0 OR BSD-2-Clause, 1× BSD-3-Clause, 1× MIT License, 1× Mozilla Public License 2.0 (MPL 2.0)

Full breakdown — 9 packages
Package Version License URL
build 1.4.2 MIT link
certifi 2026.2.25 Mozilla Public License 2.0 (MPL 2.0) link
charset-normalizer 3.4.6 MIT link
difficult_dialogs 0.5.1a1 Apache Software License link
idna 3.11 BSD-3-Clause link
packaging 26.0 Apache-2.0 OR BSD-2-Clause link
pyproject_hooks 1.2.0 MIT License link
requests 2.33.1 Apache Software License link
urllib3 2.6.3 MIT link

Policy: Apache 2.0 (universal donor). StrongCopyleft / NetworkCopyleft / WeakCopyleft / Other / Error categories fail. MPL allowed.

📊 Coverage

Charting the progress of our testing efforts. 📉

✅ 99.0% total coverage

Full report: download the coverage-report artifact.

🔒 Security (pip-audit)

Ensuring our defenses are strong against vulnerabilities. 🏰

✅ No known vulnerabilities found (32 packages scanned).

🔍 Lint

Another day, another successful automated run. 🌅

❌ ruff: issues found — see job log

Your 24/7 automated code reviewer 🌙

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ignore-for-release

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@JarbasAl