taipy
A 360° open-source platform from Python pilots to production-ready web apps.
View on Github
Activity
- Latest release
- 6mo ago
- Total releases
- 17
- Cadence
- ~2 months
- Last 12 months
- 1
Reach
- Stars
- —
Details
- License
- Apache-2.0
- First release
- Apr 07, 2022
| Version | Released | |
|---|---|---|
4.1.1
patch
1 CVE
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
4.1.0
minor
1 CVE
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
4.0.3
patch
1 CVE
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
4.0.2
patch
1 CVE
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
4.0.1
patch
1 CVE
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
4.0.0
major
1 CVE
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
3.1.1
patch
3 CVEs
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-47833
PYSEC-2024-168
GHSA-r3jq-4r5c-j9hp
Oct 09, 2024
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
Low
None
Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
Updated Jan 18, 2025 · Source: OSV.dev
GHSA-pp84-v3mw-gg4w
Aug 27, 2024
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
High
SummaryIndirect CVEs affect Taipy 3.1.1 DetailsTaipy 3.1.1 is affected by two existing CVEs: CVE-2024-1681 affects flask-core <4.0.1 and taipy 3.1.1 needs <=4.0.0 CVE-2024-5629 affects pymongo <4.6.3 and taipy 3.1.1 needs <=4.6.1 Please see References for further details. Patchplease upgrade to the following versions: Fixed on patch versions: >=3.1.2 and on major releases: >=4.0.0 Impactpre-commit breaks when using dependency Taipy 3.1.1 Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
References Updated Nov 30, 2024 · Source: OSV.dev |
3.1.1
patch
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
3.1.0
minor
3 CVEs
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-47833
PYSEC-2024-168
GHSA-r3jq-4r5c-j9hp
Oct 09, 2024
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
Low
None
Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
Updated Jan 18, 2025 · Source: OSV.dev
GHSA-pp84-v3mw-gg4w
Aug 27, 2024
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
High
SummaryIndirect CVEs affect Taipy 3.1.1 DetailsTaipy 3.1.1 is affected by two existing CVEs: CVE-2024-1681 affects flask-core <4.0.1 and taipy 3.1.1 needs <=4.0.0 CVE-2024-5629 affects pymongo <4.6.3 and taipy 3.1.1 needs <=4.6.1 Please see References for further details. Patchplease upgrade to the following versions: Fixed on patch versions: >=3.1.2 and on major releases: >=4.0.0 Impactpre-commit breaks when using dependency Taipy 3.1.1 Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
References Updated Nov 30, 2024 · Source: OSV.dev |
3.1.0
minor
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
3.0.0
major
3 CVEs
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-47833
PYSEC-2024-168
GHSA-r3jq-4r5c-j9hp
Oct 09, 2024
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
Low
None
Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
Updated Jan 18, 2025 · Source: OSV.dev
GHSA-pp84-v3mw-gg4w
Aug 27, 2024
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
High
SummaryIndirect CVEs affect Taipy 3.1.1 DetailsTaipy 3.1.1 is affected by two existing CVEs: CVE-2024-1681 affects flask-core <4.0.1 and taipy 3.1.1 needs <=4.0.0 CVE-2024-5629 affects pymongo <4.6.3 and taipy 3.1.1 needs <=4.6.1 Please see References for further details. Patchplease upgrade to the following versions: Fixed on patch versions: >=3.1.2 and on major releases: >=4.0.0 Impactpre-commit breaks when using dependency Taipy 3.1.1 Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
References Updated Nov 30, 2024 · Source: OSV.dev | ||
2.4.0
minor
3 CVEs
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-47833
PYSEC-2024-168
GHSA-r3jq-4r5c-j9hp
Oct 09, 2024
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
Low
None
Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
Updated Jan 18, 2025 · Source: OSV.dev
GHSA-pp84-v3mw-gg4w
Aug 27, 2024
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
High
SummaryIndirect CVEs affect Taipy 3.1.1 DetailsTaipy 3.1.1 is affected by two existing CVEs: CVE-2024-1681 affects flask-core <4.0.1 and taipy 3.1.1 needs <=4.0.0 CVE-2024-5629 affects pymongo <4.6.3 and taipy 3.1.1 needs <=4.6.1 Please see References for further details. Patchplease upgrade to the following versions: Fixed on patch versions: >=3.1.2 and on major releases: >=4.0.0 Impactpre-commit breaks when using dependency Taipy 3.1.1 Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
References Updated Nov 30, 2024 · Source: OSV.dev | ||
2.3.1
patch
3 CVEs
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-47833
PYSEC-2024-168
GHSA-r3jq-4r5c-j9hp
Oct 09, 2024
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
Low
None
Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
Updated Jan 18, 2025 · Source: OSV.dev
GHSA-pp84-v3mw-gg4w
Aug 27, 2024
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
High
SummaryIndirect CVEs affect Taipy 3.1.1 DetailsTaipy 3.1.1 is affected by two existing CVEs: CVE-2024-1681 affects flask-core <4.0.1 and taipy 3.1.1 needs <=4.0.0 CVE-2024-5629 affects pymongo <4.6.3 and taipy 3.1.1 needs <=4.6.1 Please see References for further details. Patchplease upgrade to the following versions: Fixed on patch versions: >=3.1.2 and on major releases: >=4.0.0 Impactpre-commit breaks when using dependency Taipy 3.1.1 Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
References Updated Nov 30, 2024 · Source: OSV.dev | ||
2.3.0
minor
3 CVEs
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-47833
PYSEC-2024-168
GHSA-r3jq-4r5c-j9hp
Oct 09, 2024
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
Low
None
Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
Updated Jan 18, 2025 · Source: OSV.dev
GHSA-pp84-v3mw-gg4w
Aug 27, 2024
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
High
SummaryIndirect CVEs affect Taipy 3.1.1 DetailsTaipy 3.1.1 is affected by two existing CVEs: CVE-2024-1681 affects flask-core <4.0.1 and taipy 3.1.1 needs <=4.0.0 CVE-2024-5629 affects pymongo <4.6.3 and taipy 3.1.1 needs <=4.6.1 Please see References for further details. Patchplease upgrade to the following versions: Fixed on patch versions: >=3.1.2 and on major releases: >=4.0.0 Impactpre-commit breaks when using dependency Taipy 3.1.1 Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
References Updated Nov 30, 2024 · Source: OSV.dev | ||
2.2.0
minor
3 CVEs
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-47833
PYSEC-2024-168
GHSA-r3jq-4r5c-j9hp
Oct 09, 2024
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
Low
None
Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
Updated Jan 18, 2025 · Source: OSV.dev
GHSA-pp84-v3mw-gg4w
Aug 27, 2024
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
High
SummaryIndirect CVEs affect Taipy 3.1.1 DetailsTaipy 3.1.1 is affected by two existing CVEs: CVE-2024-1681 affects flask-core <4.0.1 and taipy 3.1.1 needs <=4.0.0 CVE-2024-5629 affects pymongo <4.6.3 and taipy 3.1.1 needs <=4.6.1 Please see References for further details. Patchplease upgrade to the following versions: Fixed on patch versions: >=3.1.2 and on major releases: >=4.0.0 Impactpre-commit breaks when using dependency Taipy 3.1.1 Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
References Updated Nov 30, 2024 · Source: OSV.dev | ||
2.1.0
minor
3 CVEs
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-47833
PYSEC-2024-168
GHSA-r3jq-4r5c-j9hp
Oct 09, 2024
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
Low
None
Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
Updated Jan 18, 2025 · Source: OSV.dev
GHSA-pp84-v3mw-gg4w
Aug 27, 2024
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
High
SummaryIndirect CVEs affect Taipy 3.1.1 DetailsTaipy 3.1.1 is affected by two existing CVEs: CVE-2024-1681 affects flask-core <4.0.1 and taipy 3.1.1 needs <=4.0.0 CVE-2024-5629 affects pymongo <4.6.3 and taipy 3.1.1 needs <=4.6.1 Please see References for further details. Patchplease upgrade to the following versions: Fixed on patch versions: >=3.1.2 and on major releases: >=4.0.0 Impactpre-commit breaks when using dependency Taipy 3.1.1 Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
References Updated Nov 30, 2024 · Source: OSV.dev | ||
2.0.0
major
3 CVEs
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-47833
PYSEC-2024-168
GHSA-r3jq-4r5c-j9hp
Oct 09, 2024
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
Low
None
Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
Updated Jan 18, 2025 · Source: OSV.dev
GHSA-pp84-v3mw-gg4w
Aug 27, 2024
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
High
SummaryIndirect CVEs affect Taipy 3.1.1 DetailsTaipy 3.1.1 is affected by two existing CVEs: CVE-2024-1681 affects flask-core <4.0.1 and taipy 3.1.1 needs <=4.0.0 CVE-2024-5629 affects pymongo <4.6.3 and taipy 3.1.1 needs <=4.6.1 Please see References for further details. Patchplease upgrade to the following versions: Fixed on patch versions: >=3.1.2 and on major releases: >=4.0.0 Impactpre-commit breaks when using dependency Taipy 3.1.1 Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
References Updated Nov 30, 2024 · Source: OSV.dev | ||
1.1.0
minor
3 CVEs
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-47833
PYSEC-2024-168
GHSA-r3jq-4r5c-j9hp
Oct 09, 2024
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
Low
None
Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
Updated Jan 18, 2025 · Source: OSV.dev
GHSA-pp84-v3mw-gg4w
Aug 27, 2024
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
High
SummaryIndirect CVEs affect Taipy 3.1.1 DetailsTaipy 3.1.1 is affected by two existing CVEs: CVE-2024-1681 affects flask-core <4.0.1 and taipy 3.1.1 needs <=4.0.0 CVE-2024-5629 affects pymongo <4.6.3 and taipy 3.1.1 needs <=4.6.1 Please see References for further details. Patchplease upgrade to the following versions: Fixed on patch versions: >=3.1.2 and on major releases: >=4.0.0 Impactpre-commit breaks when using dependency Taipy 3.1.1 Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
References Updated Nov 30, 2024 · Source: OSV.dev | ||
1.0.0
initial
3 CVEs
CVE-2026-48544
PYSEC-2026-3081
GHSA-28gh-q3gw-pvx8
Jul 13, 2026
Taipy contains a path traversal vulnerability
High
Network
Low
None
None
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
4.0.0
+ 5 more Show less
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-47833
PYSEC-2024-168
GHSA-r3jq-4r5c-j9hp
Oct 09, 2024
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
Low
Low
None
Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
Updated Jan 18, 2025 · Source: OSV.dev
GHSA-pp84-v3mw-gg4w
Aug 27, 2024
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
High
SummaryIndirect CVEs affect Taipy 3.1.1 DetailsTaipy 3.1.1 is affected by two existing CVEs: CVE-2024-1681 affects flask-core <4.0.1 and taipy 3.1.1 needs <=4.0.0 CVE-2024-5629 affects pymongo <4.6.3 and taipy 3.1.1 needs <=4.6.1 Please see References for further details. Patchplease upgrade to the following versions: Fixed on patch versions: >=3.1.2 and on major releases: >=4.0.0 Impactpre-commit breaks when using dependency Taipy 3.1.1 Affected versions
1.0.0
1.1.0
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
3.0.0
3.1.0
3.1.1
Fixed in
4.0.0
References Updated Nov 30, 2024 · Source: OSV.dev |