CVE-2026-85183

Critical · CVSS 9.3

CVSS: 9.3; nvd
EPSS: 0.15%; 5th pct
KEV: No
Class: oss containerizable; CWE-1385

Description

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.

References

https://github.com/Avaiga/taipy
https://github.com/Avaiga/taipy/blob/4.1.1/taipy/gui/server.py
https://github.com/Avaiga/taipy/issues/2890
https://www.vulncheck.com/advisories/taipy-through-4.1.1-cross-site-websocket-hijacking-via-wildcard-socket-io-cors
https://github.com/Avaiga/taipy/issues/2890

Status: profiled · ingested 2026-09-10T18:00:00.000Z