Skip to content
AI Sec Watch
LowVulnerability

CVE-2026-10804: Streamlit weak hash in palette handler caching

Source
NVD(opens in a new tab)
Identifier
CVE-2026-10804
Published
Record updated
View JSON
Affected
  • streamlit < 1.53.1
Fixed in
1.53.1
  • released January 22, 2026, 133 days before disclosure
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
<0.1%

Summary

A vulnerability in Streamlit up to 1.53.0 affects an unknown function in lib/streamlit/runtime/caching/hashing.py, part of the Palette Handler component, and leads to use of a weak hash. Exploitation requires local access and a high level of complexity, and the source considers it difficult. The exploit has been publicly disclosed and may be used, and a pull request to fix it awaits acceptance.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.