pypi package report

Is shiny safe?

1 known vulnerability, worst severity MODERATE.

// reach

93 direct dependencies

22 carry known advisories, worst CRITICAL

9 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage

No published models are known to use this package.

cvss
0.0
medium

severity band, no base score published

epss
not scored

chance of exploitation in 30 days

xyz score
not scored

CyberXYZ composite out of 10

fig. 01 — GHSA-47c3-hpmg-7j6p, the advisory selected below

// 1 advisories

GHSA-47c3-hpmg-7j6p

MODERATECVE-2026-108258
// impact

Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory (/shinybookmarks/) without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open and parse input.json and values.json from a directory outside the bookmark store.

On a default application the restore was attempted whenever the client supplied a URL query string — including when bookmarking was disabled (bookmarkstore="disable") — so no opt-in configuration was required. For such applications the impact is an unauthenticated, server-side probe for the existence and JSON-validity of attacker-chosen paths, constrained to those two file names.

Applications configured with bookmarkstore="server" and using ui.inputfile() are affected more seriously. The file-input restore handler copies files out of the restore directory, so the contents of an attacker-selected file name within an attacker-selected directory could be read into the application.

// affected versions

1.4.0 through 1.6.3. Bookmarking was introduced in 1.4.0; earlier releases do not contain the affected code path and are not affected.

// patches

Fixed in 1.6.4. Upgrade with:

pip install --upgrade shiny

The fix validates bookmark IDs against an allowlist — a single path segment matching [A-Za-z0-9-]+, which cannot express a path separator, a .. parent reference, or an absolute path — before the ID is used to build a filesystem path. Bookmark IDs generated by Shiny are unaffected by this restriction. Restore is additionally gated on the application's bookmarkstore setting at a single point, so it no longer runs when bookmarking is disabled, and the on-disk restore path is honored only under bookmarkstore="server".

// workarounds

There is no configuration change that mitigates this on an affected version: the restore path ran even with bookmarkstore="disable". Deployments that cannot upgrade immediately can strip the stateid parameter from incoming query strings at a reverse proxy or load balancer, which prevents the affected code path from being reached.

// credits

Reported by @0xRenSec.

Checked 2026-10-09 at 23:57 UTC. The most recent advisory here was published 2026-10-09. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.