Taipy

Taipy misconfigures its socket.io server with wildcard CORS and credentials enabled, permitting arbitrary domains to perform authenticated actions and state modifications via WebSockets without CSRF protections.

Taipy 4.1.1 contains a path traversal vulnerability (CVE-2026-48544) in the ElementLibrary.get_resource() method that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check, enabling unauthorized file access outside the intended library directory.