CVE-2024-41113

Name of the Vulnerable Software and Affected Versions streamlit-geospatial versions prior to commit c4f81d9616d40c60584e36abb15300853a66e489

Description The issue arises from user input being taken by the vis params variable, which is later used in the eval() function, leading to remote code execution. This occurs in the pages/1 📷 Timelapse.py file, specifically on lines 383, 390, and 395.

Recommendations For versions prior to commit c4f81d9616d40c60584e36abb15300853a66e489, update to a version that includes the fix from commit c4f81d9616d40c60584e36abb15300853a66e489 to resolve the issue. As a temporary workaround, consider restricting user input to the vis params variable or avoiding the use of the eval() function until the update is applied.