by Kastro
Paper/Archive/CVE-2026-85183

CVE-2026-85183

Avaiga taipy — Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

EPSS 0.2%public exploitCVSS 9.3
critical.is priorityof 100
41
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 14.4.144 × 202.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.

Affected

ProductAffectedFixed inSource
taipy≤ 4.1.1–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
VulnCheck (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/Avaiga/taipy/issues/2890refgithub.com/Avaiga/taipywriteupgithub.com/Avaiga/taipy/blob/4.1.1/taipy/gui/server.pywriteupvulncheck.com/advisories/taipy-through-4.1.1-cross-site-websocket-hijacking-via-wildcard-socket-io-cors