{"id":"CVE-2026-10804","aliases":["GHSA-vqwp-45wm-r9r5","PYSEC-2026-212"],"title":"Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission","summary":"Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission","severity":"low","cvss":3.6,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","vendor":"streamlit","product":"streamlit","ecosystem":"pip","affected":["streamlit < 1.53.1"],"patched":["streamlit 1.53.1"],"published":"2026-06-04","updated":"2026-07-15","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-vqwp-45wm-r9r5","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10804"},{"url":"https://github.com/streamlit/streamlit/issues/14622"},{"url":"https://github.com/streamlit/streamlit/pull/14635"},{"url":"https://github.com/streamlit/streamlit/pull/15397"},{"url":"https://github.com/streamlit/streamlit/commit/fec0f584dae9261abed16cad35b32922104bb933"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/streamlit/PYSEC-2026-212.yaml"},{"url":"https://github.com/streamlit/streamlit"},{"url":"https://vuldb.com/cve/CVE-2026-10804"},{"url":"https://vuldb.com/submit/831508"},{"url":"https://vuldb.com/vuln/368253"},{"url":"https://vuldb.com/vuln/368253/cti"}],"tags":["osv","pip"],"epss":0.00083,"epssPercentile":0.00236,"ingestedAt":"2026-07-16T18:59:41.726Z","slug":"CVE-2026-10804","body":"## Overview\n\nA vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.\n\n## Affected packages\n\n- `streamlit < 1.53.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `streamlit 1.53.1`","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":19.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}