CVE-2026-85183

critical · 9.3

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.

9.3

CVSS

0.2%

EPSS (exploit prob.)

14th

EPSS percentile

2026-09-03

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-1385

References

https://github.com/Avaiga/taipy
https://github.com/Avaiga/taipy/blob/4.1.1/taipy/gui/server.py
https://github.com/Avaiga/taipy/issues/2890
https://www.vulncheck.com/advisories/taipy-through-4.1.1-cross-site-websocket-hijacking-via-wildcard-socket-io-cors
https://github.com/Avaiga/taipy/issues/2890

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-85183