The impact is significant, as attackers can achieve Remote Code Execution (RCE) by manipulating the Gui.__SELF_VAR attribute used within internal eval() calls. Furthermore, the vulnerability enables credential exfiltration, such as OpenAI API tokens, by redirecting outbound application traffic, as well as enabling Reflected XSS and Denial of Service (DoS) by crashing the application or injecting malicious content into rendered responses. This flaw represents a critical security risk for any Taipy deployment exposing application state management to client-side input.

Attack Chain

1. Attacker establishes a WebSocket connection to the targeted Taipy application.
2. Attacker crafts a malicious message payload containing an attribute path injection string (e.g., _TpN_tpec_TpExPr...).
3. The message is sent to the Taipy server, where it is processed by _manage_message.
4. The _setscopeattr_drill function is triggered, passing the attacker's input to the recursive _attrsetter function.
5. The _attrsetter function uses setattr and getattr to traverse and modify server-side object attributes based on the attacker's path.
6. Attacker targets specific internal attributes such as Gui.__SELF_VAR or method attributes on _TaipyBase.
7. Upon subsequent application logic execution, the modified attributes are accessed or evaluated (e.g., via eval()).
8. Final objective achieved: RCE, credential exfiltration, XSS injection, or application crash.

Impact

The vulnerability affects Taipy v4.0.3 users. Successful exploitation allows for complete server compromise through RCE, theft of sensitive configuration secrets like OpenAI tokens, disruption of services via DoS, and potential account takeover via XSS. Given the availability of public proof-of-concept exploits, the risk to unpatched infrastructure is high.

Recommendation

Prioritize the following actions to detect and mitigate CVE-2025-30374:

• Update Taipy to a patched version immediately upon vendor release.
• Implement strict server-side validation for all input parameters received via WebSocket messages in _manage_message.
• Block or inspect WebSocket traffic containing deeply nested attribute paths or sequences targeting internal application classes.
• Audit infrastructure logs for unauthorized WebSocket messages containing __class__, __base__, or __SELF_VAR patterns.