Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-85183, describes a Cross-Site WebSocket Hijacking (CSWSH) issue in Taipy through version 4.1.1. The core problem is the misconfiguration of the socket.io server's CORS settings. The get_commit_urls_from_issue tool did not return specific commit URLs, but the content of the GitHub issue (issue #2890) provided a highly detailed explanation of the vulnerability, including the exact file and lines of code responsible.
The _FlaskServer.__init__ function in taipy/gui/servers/flask/server.py is identified as the origin of the vulnerability. It explicitly sets cors_allowed_origins to "*" in the socketio_config. When combined with the default Access-Control-Allow-Credentials: true setting in python-engineio, this allows browsers to send victim's cookies with cross-origin requests, enabling an attacker to establish a credentialed WebSocket connection from an arbitrary domain.
Once a malicious cross-origin connection is established, the _manage_ws_message function in taipy/gui/gui.py becomes the target for exploitation. This function is responsible for processing various WebSocket message types (UPDATE, ACTION, DATA_UPDATE, REQUEST_UPDATE) that directly manipulate the application's state, trigger callbacks, and manage file downloads. Without proper CSRF protection or per-message credential checks, an attacker can leverage this function to read sensitive data, modify application state, and execute arbitrary actions within the victim's session. Both functions are critical to the vulnerability's existence and exploitation flow, and would appear in a runtime profiler during an attack.
_FlaskServer.__init__taipy/gui/servers/flask/server.py
_manage_ws_messagetaipy/gui/gui.py