shiny

Version	Released
`1.9.0` minor	Oct 29, 2026
`1.8.0` minor	Sep 13, 2026
`1.7.0` minor	Jul 29, 2026
`1.6.4` patch	Jul 28, 2026
`1.6.3` patch 1 CVE	Jun 01, 2026
`1.6.2` patch 1 CVE	May 21, 2026
`1.6.1` patch 1 CVE	May 01, 2026
`1.6.0` minor 1 CVE	Mar 20, 2026
`1.5.1` patch 1 CVE	Dec 08, 2025
`1.5.0` minor 1 CVE	Sep 11, 2025
`1.4.0` minor 1 CVE	Apr 08, 2025
`1.3.0` minor	Mar 03, 2025
`1.2.1` patch	Nov 14, 2024
`1.2.0` minor	Oct 29, 2024
`1.1.0` minor	Sep 03, 2024
`1.0.0` major	Jul 18, 2024
`0.10.2` patch	May 28, 2024
`0.10.1` patch	May 23, 2024
`0.10.0` minor	May 23, 2024
`0.9.0` minor	Apr 16, 2024
`0.8.1` patch	Mar 07, 2024
`0.8.0` minor	Mar 04, 2024
`0.7.1` patch	Feb 05, 2024
`0.7.0` minor	Jan 25, 2024
`0.6.1.1` patch	Dec 22, 2023
`0.6.1` patch	Dec 19, 2023
`0.6.0` minor	Oct 30, 2023
`0.5.1` patch	Aug 08, 2023
`0.5.0` minor	Aug 01, 2023
`0.4.0` minor	Jun 26, 2023
`0.3.3` patch	Apr 26, 2023
`0.3.2` patch	Apr 19, 2023
`0.3.1` patch	Apr 19, 2023
`0.3.0` minor	Apr 03, 2023
`0.2.10` patch	Mar 11, 2023
`0.2.9` patch	Nov 03, 2022
`0.2.8` patch	Oct 20, 2022
`0.2.7` patch	Sep 27, 2022
`0.2.6` patch	Sep 02, 2022
`0.2.5` patch	Aug 13, 2022
`0.2.4` patch	Aug 01, 2022
`0.2.3` patch	Jul 28, 2022
`0.2.2` patch	Jul 27, 2022
`0.2.1` minor	Jul 27, 2022
`0.1` initial	Aug 07, 2009

1.9.0 minor

Oct 29, 2026

1.8.0 minor

Sep 13, 2026

1.7.0 minor

Jul 29, 2026

1.6.4 patch

Jul 28, 2026

1.6.3 patch

1 CVE

CVE-2026-108258 PYSEC-2026-4300 GHSA-47c3-hpmg-7j6p Oct 15, 2026

Shiny for Python has path traversal in bookmark restore

Medium

Network Low None None

Impact

Shiny for Python's bookmark-restore path accepted a client-supplied _state_id_ query-string value and joined it into the server-side bookmark directory (<cwd>/shiny_bookmarks/<id>) without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open and parse input.json and values.json from a directory outside the bookmark store.

On a default application the restore was attempted whenever the client supplied a URL query string — including when bookmarking was disabled (bookmark_store="disable") — so no opt-in configuration was required. For such applications the impact is an unauthenticated, server-side probe for the existence and JSON-validity of attacker-chosen paths, constrained to those two file names.

Applications configured with bookmark_store="server" and using ui.input_file() are affected more seriously. The file-input restore handler copies files out of the restore directory, so the contents of an attacker-selected file name within an attacker-selected directory could be read into the application.

Affected versions

1.4.0 through 1.6.3. Bookmarking was introduced in 1.4.0; earlier releases do not contain the affected code path and are not affected.

Patches

Fixed in 1.6.4. Upgrade with:

pip install --upgrade shiny

The fix validates bookmark IDs against an allowlist — a single path segment matching [A-Za-z0-9_-]+, which cannot express a path separator, a .. parent reference, or an absolute path — before the ID is used to build a filesystem path. Bookmark IDs generated by Shiny are unaffected by this restriction. Restore is additionally gated on the application's bookmark_store setting at a single point, so it no longer runs when bookmarking is disabled, and the on-disk restore path is honored only under bookmark_store="server".

Workarounds

There is no configuration change that mitigates this on an affected version: the restore path ran even with bookmark_store="disable". Deployments that cannot upgrade immediately can strip the _state_id_ parameter from incoming query strings at a reverse proxy or load balancer, which prevents the affected code path from being reached.

Credits

Reported by @0xRenSec.

Affected versions


          1.4.0


          1.5.0


          1.5.1


          1.6.0


          1.6.1


          1.6.2


          1.6.3

Fixed in


          1.6.4

References

Updated Oct 15, 2026 · Source: OSV.dev

Jun 01, 2026

1.6.2 patch

1 CVE

CVE-2026-108258 PYSEC-2026-4300 GHSA-47c3-hpmg-7j6p Oct 15, 2026

Shiny for Python has path traversal in bookmark restore

Medium

Network Low None None

Impact

Shiny for Python's bookmark-restore path accepted a client-supplied _state_id_ query-string value and joined it into the server-side bookmark directory (<cwd>/shiny_bookmarks/<id>) without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open and parse input.json and values.json from a directory outside the bookmark store.

On a default application the restore was attempted whenever the client supplied a URL query string — including when bookmarking was disabled (bookmark_store="disable") — so no opt-in configuration was required. For such applications the impact is an unauthenticated, server-side probe for the existence and JSON-validity of attacker-chosen paths, constrained to those two file names.

Applications configured with bookmark_store="server" and using ui.input_file() are affected more seriously. The file-input restore handler copies files out of the restore directory, so the contents of an attacker-selected file name within an attacker-selected directory could be read into the application.

Affected versions

1.4.0 through 1.6.3. Bookmarking was introduced in 1.4.0; earlier releases do not contain the affected code path and are not affected.

Patches

Fixed in 1.6.4. Upgrade with:

pip install --upgrade shiny

The fix validates bookmark IDs against an allowlist — a single path segment matching [A-Za-z0-9_-]+, which cannot express a path separator, a .. parent reference, or an absolute path — before the ID is used to build a filesystem path. Bookmark IDs generated by Shiny are unaffected by this restriction. Restore is additionally gated on the application's bookmark_store setting at a single point, so it no longer runs when bookmarking is disabled, and the on-disk restore path is honored only under bookmark_store="server".

Workarounds

There is no configuration change that mitigates this on an affected version: the restore path ran even with bookmark_store="disable". Deployments that cannot upgrade immediately can strip the _state_id_ parameter from incoming query strings at a reverse proxy or load balancer, which prevents the affected code path from being reached.

Credits

Reported by @0xRenSec.

Affected versions


          1.4.0


          1.5.0


          1.5.1


          1.6.0


          1.6.1


          1.6.2


          1.6.3

Fixed in


          1.6.4

References

Updated Oct 15, 2026 · Source: OSV.dev

May 21, 2026

1.6.1 patch

1 CVE

CVE-2026-108258 PYSEC-2026-4300 GHSA-47c3-hpmg-7j6p Oct 15, 2026

Shiny for Python has path traversal in bookmark restore

Medium

Network Low None None

Impact

Shiny for Python's bookmark-restore path accepted a client-supplied _state_id_ query-string value and joined it into the server-side bookmark directory (<cwd>/shiny_bookmarks/<id>) without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open and parse input.json and values.json from a directory outside the bookmark store.

On a default application the restore was attempted whenever the client supplied a URL query string — including when bookmarking was disabled (bookmark_store="disable") — so no opt-in configuration was required. For such applications the impact is an unauthenticated, server-side probe for the existence and JSON-validity of attacker-chosen paths, constrained to those two file names.

Applications configured with bookmark_store="server" and using ui.input_file() are affected more seriously. The file-input restore handler copies files out of the restore directory, so the contents of an attacker-selected file name within an attacker-selected directory could be read into the application.

Affected versions

1.4.0 through 1.6.3. Bookmarking was introduced in 1.4.0; earlier releases do not contain the affected code path and are not affected.

Patches

Fixed in 1.6.4. Upgrade with:

pip install --upgrade shiny

The fix validates bookmark IDs against an allowlist — a single path segment matching [A-Za-z0-9_-]+, which cannot express a path separator, a .. parent reference, or an absolute path — before the ID is used to build a filesystem path. Bookmark IDs generated by Shiny are unaffected by this restriction. Restore is additionally gated on the application's bookmark_store setting at a single point, so it no longer runs when bookmarking is disabled, and the on-disk restore path is honored only under bookmark_store="server".

Workarounds

There is no configuration change that mitigates this on an affected version: the restore path ran even with bookmark_store="disable". Deployments that cannot upgrade immediately can strip the _state_id_ parameter from incoming query strings at a reverse proxy or load balancer, which prevents the affected code path from being reached.

Credits

Reported by @0xRenSec.

Affected versions


          1.4.0


          1.5.0


          1.5.1


          1.6.0


          1.6.1


          1.6.2


          1.6.3

Fixed in


          1.6.4

References

Updated Oct 15, 2026 · Source: OSV.dev

May 01, 2026

1.6.0 minor

1 CVE

CVE-2026-108258 PYSEC-2026-4300 GHSA-47c3-hpmg-7j6p Oct 15, 2026

Shiny for Python has path traversal in bookmark restore

Medium

Network Low None None

Impact

Shiny for Python's bookmark-restore path accepted a client-supplied _state_id_ query-string value and joined it into the server-side bookmark directory (<cwd>/shiny_bookmarks/<id>) without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open and parse input.json and values.json from a directory outside the bookmark store.

On a default application the restore was attempted whenever the client supplied a URL query string — including when bookmarking was disabled (bookmark_store="disable") — so no opt-in configuration was required. For such applications the impact is an unauthenticated, server-side probe for the existence and JSON-validity of attacker-chosen paths, constrained to those two file names.

Applications configured with bookmark_store="server" and using ui.input_file() are affected more seriously. The file-input restore handler copies files out of the restore directory, so the contents of an attacker-selected file name within an attacker-selected directory could be read into the application.

Affected versions

1.4.0 through 1.6.3. Bookmarking was introduced in 1.4.0; earlier releases do not contain the affected code path and are not affected.

Patches

Fixed in 1.6.4. Upgrade with:

pip install --upgrade shiny

The fix validates bookmark IDs against an allowlist — a single path segment matching [A-Za-z0-9_-]+, which cannot express a path separator, a .. parent reference, or an absolute path — before the ID is used to build a filesystem path. Bookmark IDs generated by Shiny are unaffected by this restriction. Restore is additionally gated on the application's bookmark_store setting at a single point, so it no longer runs when bookmarking is disabled, and the on-disk restore path is honored only under bookmark_store="server".

Workarounds

There is no configuration change that mitigates this on an affected version: the restore path ran even with bookmark_store="disable". Deployments that cannot upgrade immediately can strip the _state_id_ parameter from incoming query strings at a reverse proxy or load balancer, which prevents the affected code path from being reached.

Credits

Reported by @0xRenSec.

Affected versions


          1.4.0


          1.5.0


          1.5.1


          1.6.0


          1.6.1


          1.6.2


          1.6.3

Fixed in


          1.6.4

References

Updated Oct 15, 2026 · Source: OSV.dev

Mar 20, 2026

1.5.1 patch

1 CVE

CVE-2026-108258 PYSEC-2026-4300 GHSA-47c3-hpmg-7j6p Oct 15, 2026

Shiny for Python has path traversal in bookmark restore

Medium

Network Low None None

Impact

Shiny for Python's bookmark-restore path accepted a client-supplied _state_id_ query-string value and joined it into the server-side bookmark directory (<cwd>/shiny_bookmarks/<id>) without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open and parse input.json and values.json from a directory outside the bookmark store.

On a default application the restore was attempted whenever the client supplied a URL query string — including when bookmarking was disabled (bookmark_store="disable") — so no opt-in configuration was required. For such applications the impact is an unauthenticated, server-side probe for the existence and JSON-validity of attacker-chosen paths, constrained to those two file names.

Applications configured with bookmark_store="server" and using ui.input_file() are affected more seriously. The file-input restore handler copies files out of the restore directory, so the contents of an attacker-selected file name within an attacker-selected directory could be read into the application.

Affected versions

1.4.0 through 1.6.3. Bookmarking was introduced in 1.4.0; earlier releases do not contain the affected code path and are not affected.

Patches

Fixed in 1.6.4. Upgrade with:

pip install --upgrade shiny

The fix validates bookmark IDs against an allowlist — a single path segment matching [A-Za-z0-9_-]+, which cannot express a path separator, a .. parent reference, or an absolute path — before the ID is used to build a filesystem path. Bookmark IDs generated by Shiny are unaffected by this restriction. Restore is additionally gated on the application's bookmark_store setting at a single point, so it no longer runs when bookmarking is disabled, and the on-disk restore path is honored only under bookmark_store="server".

Workarounds

There is no configuration change that mitigates this on an affected version: the restore path ran even with bookmark_store="disable". Deployments that cannot upgrade immediately can strip the _state_id_ parameter from incoming query strings at a reverse proxy or load balancer, which prevents the affected code path from being reached.

Credits

Reported by @0xRenSec.

Affected versions


          1.4.0


          1.5.0


          1.5.1


          1.6.0


          1.6.1


          1.6.2


          1.6.3

Fixed in


          1.6.4

References

Updated Oct 15, 2026 · Source: OSV.dev

Dec 08, 2025

1.5.0 minor

1 CVE

CVE-2026-108258 PYSEC-2026-4300 GHSA-47c3-hpmg-7j6p Oct 15, 2026

Shiny for Python has path traversal in bookmark restore

Medium

Network Low None None

Impact

Shiny for Python's bookmark-restore path accepted a client-supplied _state_id_ query-string value and joined it into the server-side bookmark directory (<cwd>/shiny_bookmarks/<id>) without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open and parse input.json and values.json from a directory outside the bookmark store.

On a default application the restore was attempted whenever the client supplied a URL query string — including when bookmarking was disabled (bookmark_store="disable") — so no opt-in configuration was required. For such applications the impact is an unauthenticated, server-side probe for the existence and JSON-validity of attacker-chosen paths, constrained to those two file names.

Applications configured with bookmark_store="server" and using ui.input_file() are affected more seriously. The file-input restore handler copies files out of the restore directory, so the contents of an attacker-selected file name within an attacker-selected directory could be read into the application.

Affected versions

1.4.0 through 1.6.3. Bookmarking was introduced in 1.4.0; earlier releases do not contain the affected code path and are not affected.

Patches

Fixed in 1.6.4. Upgrade with:

pip install --upgrade shiny

The fix validates bookmark IDs against an allowlist — a single path segment matching [A-Za-z0-9_-]+, which cannot express a path separator, a .. parent reference, or an absolute path — before the ID is used to build a filesystem path. Bookmark IDs generated by Shiny are unaffected by this restriction. Restore is additionally gated on the application's bookmark_store setting at a single point, so it no longer runs when bookmarking is disabled, and the on-disk restore path is honored only under bookmark_store="server".

Workarounds

There is no configuration change that mitigates this on an affected version: the restore path ran even with bookmark_store="disable". Deployments that cannot upgrade immediately can strip the _state_id_ parameter from incoming query strings at a reverse proxy or load balancer, which prevents the affected code path from being reached.

Credits

Reported by @0xRenSec.

Affected versions


          1.4.0


          1.5.0


          1.5.1


          1.6.0


          1.6.1


          1.6.2


          1.6.3

Fixed in


          1.6.4

References

Updated Oct 15, 2026 · Source: OSV.dev

Sep 11, 2025

1.4.0 minor

1 CVE

CVE-2026-108258 PYSEC-2026-4300 GHSA-47c3-hpmg-7j6p Oct 15, 2026

Shiny for Python has path traversal in bookmark restore

Medium

Network Low None None

Impact

Shiny for Python's bookmark-restore path accepted a client-supplied _state_id_ query-string value and joined it into the server-side bookmark directory (<cwd>/shiny_bookmarks/<id>) without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open and parse input.json and values.json from a directory outside the bookmark store.

On a default application the restore was attempted whenever the client supplied a URL query string — including when bookmarking was disabled (bookmark_store="disable") — so no opt-in configuration was required. For such applications the impact is an unauthenticated, server-side probe for the existence and JSON-validity of attacker-chosen paths, constrained to those two file names.

Applications configured with bookmark_store="server" and using ui.input_file() are affected more seriously. The file-input restore handler copies files out of the restore directory, so the contents of an attacker-selected file name within an attacker-selected directory could be read into the application.

Affected versions

1.4.0 through 1.6.3. Bookmarking was introduced in 1.4.0; earlier releases do not contain the affected code path and are not affected.

Patches

Fixed in 1.6.4. Upgrade with:

pip install --upgrade shiny

The fix validates bookmark IDs against an allowlist — a single path segment matching [A-Za-z0-9_-]+, which cannot express a path separator, a .. parent reference, or an absolute path — before the ID is used to build a filesystem path. Bookmark IDs generated by Shiny are unaffected by this restriction. Restore is additionally gated on the application's bookmark_store setting at a single point, so it no longer runs when bookmarking is disabled, and the on-disk restore path is honored only under bookmark_store="server".

Workarounds

There is no configuration change that mitigates this on an affected version: the restore path ran even with bookmark_store="disable". Deployments that cannot upgrade immediately can strip the _state_id_ parameter from incoming query strings at a reverse proxy or load balancer, which prevents the affected code path from being reached.

Credits

Reported by @0xRenSec.

Affected versions


          1.4.0


          1.5.0


          1.5.1


          1.6.0


          1.6.1


          1.6.2


          1.6.3

Fixed in


          1.6.4

References

Updated Oct 15, 2026 · Source: OSV.dev

Apr 08, 2025

1.3.0 minor

Mar 03, 2025

1.2.1 patch

Nov 14, 2024

1.2.0 minor

Oct 29, 2024

1.1.0 minor

Sep 03, 2024

1.0.0 major

Jul 18, 2024

0.10.2 patch

May 28, 2024

0.10.1 patch

May 23, 2024

0.10.0 minor

May 23, 2024

0.9.0 minor

Apr 16, 2024

0.8.1 patch

Mar 07, 2024

0.8.0 minor

Mar 04, 2024

0.7.1 patch

Feb 05, 2024

0.7.0 minor

Jan 25, 2024

0.6.1.1 patch

Dec 22, 2023

0.6.1 patch

Dec 19, 2023

0.6.0 minor

Oct 30, 2023

0.5.1 patch

Aug 08, 2023

0.5.0 minor

Aug 01, 2023

0.4.0 minor

Jun 26, 2023

0.3.3 patch

Apr 26, 2023

0.3.2 patch

Apr 19, 2023

0.3.1 patch

Apr 19, 2023

0.3.0 minor

Apr 03, 2023

0.2.10 patch

Mar 11, 2023

0.2.9 patch

Nov 03, 2022

0.2.8 patch

Oct 20, 2022

0.2.7 patch

Sep 27, 2022

0.2.6 patch

Sep 02, 2022

0.2.5 patch

Aug 13, 2022

0.2.4 patch

Aug 01, 2022

0.2.3 patch

Jul 28, 2022

0.2.2 patch

Jul 27, 2022

0.2.1 minor

Jul 27, 2022

0.1 initial

Aug 07, 2009

Activity

Reach

Details