https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-41120.htmlhttps://patchthecve.com/cve/CVE-2024-41120.htmlWed, 17 Jun 2026 07:47:18 +0000CRITICAL 9.8: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `url` variable on line 63 of `pages/9_🔲_Vector_Data_Visualization.py` takes user input, which is later passed to the `gpd.read_file` method. `gpd.read_file` mehttps://patchthecve.com/cve/CVE-2024-41119.htmlhttps://patchthecve.com/cve/CVE-2024-41119.htmlWed, 17 Jun 2026 07:47:18 +0000CRITICAL 9.8: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` variable on line 80 in `8_🏜️_Raster_Data_Visualization.py` takes user input, which is later used in the `eval()` function on line 86, leading to rhttps://patchthecve.com/cve/CVE-2024-41118.htmlhttps://patchthecve.com/cve/CVE-2024-41118.htmlWed, 17 Jun 2026 07:47:18 +0000HIGH 7.5: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `url` variable on line 47 of `pages/7_📦_Web_Map_Service.py` takes user input, which is passed to `get_layers` function, in which `url` is used with `get_wms_lahttps://patchthecve.com/cve/CVE-2024-41117.htmlhttps://patchthecve.com/cve/CVE-2024-41117.htmlWed, 17 Jun 2026 07:47:18 +0000CRITICAL 9.8: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` variable on line 115 in `pages/10_🌍_Earth_Engine_Datasets.py` takes user input, which is later used in the `eval()` function on line 126, leading https://patchthecve.com/cve/CVE-2024-41116.htmlhttps://patchthecve.com/cve/CVE-2024-41116.htmlWed, 17 Jun 2026 07:47:18 +0000CRITICAL 9.8: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` variable on line 1254 in `pages/1_📷_Timelapse.py` takes user input, which is later used in the `eval()` function on line 1345, leading to remote chttps://patchthecve.com/cve/CVE-2024-41115.htmlhttps://patchthecve.com/cve/CVE-2024-41115.htmlWed, 17 Jun 2026 07:47:18 +0000CRITICAL 9.8: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `palette` variable on line 488 in `pages/1_📷_Timelapse.py` takes user input, which is later used in the `eval()` function on line 493, leading to remote code ehttps://patchthecve.com/cve/CVE-2024-41114.htmlhttps://patchthecve.com/cve/CVE-2024-41114.htmlWed, 17 Jun 2026 07:47:18 +0000CRITICAL 9.8: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `palette` variable on line 430 in `pages/1_📷_Timelapse.py` takes user input, which is later used in the `eval()` function on line 435, leading to remote code ehttps://patchthecve.com/cve/CVE-2024-41113.htmlhttps://patchthecve.com/cve/CVE-2024-41113.htmlWed, 17 Jun 2026 07:47:18 +0000CRITICAL 9.8: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` variable on line 383 or line 390 in `pages/1_📷_Timelapse.py` takes user input, which is later used in the `eval()` function on line 395, leading thttps://patchthecve.com/cve/CVE-2024-41112.htmlhttps://patchthecve.com/cve/CVE-2024-41112.htmlWed, 17 Jun 2026 07:47:17 +0000CRITICAL 9.8: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable in `pages/1_📷_Timelapse.py` takes user input, which is later used in the `eval()` function on line 380, leading to remote code execution. Comm