Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omissionGHSA-vqwp-45wm-r9r5
LOWFix: streamlit/streamlit#14635GHSA-vqwp-45wm-r9r5 is a low-severity (CVSS 3.6) Broken Cryptographic Algorithm vulnerability in streamlit. A fix is available for streamlit — see the affected versions and patch details below.
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for GHSA-vqwp-45wm-r9r5.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-vqwp-45wm-r9r5 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 390,400 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
streamlitReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | streamlit | all versions | 1.53.1pip install --upgrade 'streamlit==1.53.1' |
Affected Products
streamlitsnowflakeDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for streamlit, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update streamlit to 1.53.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vqwp-45wm-r9r5 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Red Hat rates this vulnerability as Low impact with a CVSS score of 3.6, lower than NIST's 4.7. Red Hat products that ship Streamlit are limited to RHEL AI bootc containers and RHOAI's NeMo Guardrails server, where the caching functions are used for internal model serving rather than processing user-uploaded datasets,…
If your application uses @st.cache_data or @st.cache_resource with large datasets from untrusted sources, validate the data before it reaches the caching layer. For DataFrames exceeding the 50,000-row sampling threshold, comparing a hash of the full dataset against the cached version before returning results can catch collisions that the built-in sampler misses. Reducing the cache TTL also limits the window during which a poisoned entry would be served to other users.Source: Red Hat security advisory for GHSA-vqwp-45wm-r9r5 (CC BY 4.0)
Frequently Asked Questions
Is GHSA-vqwp-45wm-r9r5 in your dependencies?
Find it across PyPI, including transitive dependencies.