CVE-2026-85183

Name of the Vulnerable Software and Affected Versions Taipy versions prior to 4.1.2

Description The socket.io server is configured with a wildcard Cross-Origin Resource Sharing (CORS) origin and the credential flag enabled. This configuration allows any web page to establish credentialed WebSocket connections to the application. Consequently, attackers can initiate socket.io sessions from arbitrary domains to trigger state variable modifications and action callbacks because the system lacks Cross-Site Request Forgery (CSRF) protection for these operations.

Recommendations Update to version 4.1.2 or later.