Streamlit up to 1.53.0 Palette hashing.py weak hash

Summaryinfo

A vulnerability marked as problematic has been reported in Streamlit up to 1.53.0. The affected element is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Performing a manipulation results in weak hash. This vulnerability was named CVE-2026-10804. The attack needs to be approached locally. In addition, an exploit is available. The pull request to fix this issue awaits acceptance.

Detailsinfo

A vulnerability classified as problematic has been found in Streamlit up to 1.53.0. This affects an unknown code in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. The manipulation with an unknown input leads to a weak hash vulnerability. CWE is classifying the issue as CWE-328. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). This is going to have an impact on integrity, and availability.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-10804. The exploitability is told to be difficult. An attack has to be approached locally. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1600.001 for this issue.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The pull request to fix this issue awaits acceptance.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Streamlit

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41
• 1.42
• 1.43
• 1.44
• 1.45
• 1.46
• 1.47
• 1.48
• 1.49
• 1.50
• 1.51
• 1.52
• 1.53.0

Website

• Product: https://github.com/streamlit/streamlit/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #831508: streamlit 1.53.0 hash collision (by Dem0)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion