Snapshot 255880
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content
Posit PBC Trust Center
Posit's Trust Center gives you one centralized place to access up-to-date security documentation, certifications, compliance details, audit reports, and subprocessor disclosures.
privacy@posit.co
Privacy PolicyOpens in new tab
Filter by
Compliance
GDPR
CCPA
US Data Privacy
SOC 2
Resources
View all
Policies
External Information Security Policy
Terms and Conditions
Questionnaires
Posit Team HECVAT
On Prem HECVAT
Shinyapps.io HECVAT
Connect Cloud HECVAT
View 1 more
Insurance
Certificate of Liability Insurance
Third-Party Attestations
Connect Cloud SOC 2 Report
Other resources
Posit B Corp Report 2025
Posit W9
Posit Banking Letter
IRS Tax Residency Certificate
View 1 more
Controls
Updated less than a minute ago
View all
Infrastructure security
Unique production database authentication enforced
Encryption key access restricted
Unique account authentication enforced
View 13 more Infrastructure security controls
Organizational security
Security awareness training implemented
Asset disposal procedures utilized
Production inventory maintained
View 7 more Organizational security controls
Product security
Data encryption utilized
Control self-assessments conducted
Penetration testing performed
View 2 more Product security controls
Internal security procedures
Continuity and Disaster Recovery plans established
Continuity and Disaster Recovery plans tested
Cybersecurity insurance maintained
View 27 more Internal security procedures controls
Data and privacy
Data retention procedures established
Customer data deleted upon leaving
Data classification policy established
Data Collected by Posit's on-prem software
Posit's on-prem software does not collect any customer data
Subprocessors
View all
6Sense • Optimizing advertisement and retargeting, including personal and firmographic use
US
AddEvent • Event calendar management
US
AFI.ai Backup • Google Workspace backup
US
Amazon Web Services • Cloud hosting provider
US
FAQ
View all
Updates
View all
Security
PSA-2026-0003: SQL injection in the Posit Workbench code-server session-state RPC
Published November 6, 2026
Source advisory: RStudio and Posit Workbench 2026.08.0 release notesOpens in new tab
CVE: CVE-2026-121881Opens in new tab
CWE: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
Severity: Medium (CVSS v4.0: 5.7, CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:C/RE:M/U:Amber)
Affected versions: Posit Workbench, all releases through 2026.07.1
Fixed version: 2026.08.0
Description
SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Workbench through 2026.07.1 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter. The endpoint is reachable over HTTP with only a valid session cookie, and the caller-supplied session identifiers are concatenated into the query rather than bound as parameters.
NOTE: exploitation requires an authenticated account on the Workbench server, but no administrative privileges. The vulnerability is limited to disclosure of database contents. Where the database holds credentials that are stored unencrypted, their disclosure can allow an attacker to act as other users against external services, so the impact is higher than the base score reflects.
Resolution
Upgrade Posit Workbench to 2026.08.0 or later. Download the installer for your platform from https://posit.co/download/rstudio-server/Opens in new tab and install it over the existing one — for example, on Ubuntu or Debian:
sudo apt-get install -y ./rstudio-workbench-2026.08.0-amd64.deb
From 2026.08.0 the session identifiers are bound as query parameters instead of being concatenated into the SQL statement.
No configuration workaround fully mitigates this issue on affected versions. Deployments unable to upgrade immediately can reduce exposure by limiting Workbench accounts to trusted users until the upgrade is applied.
Security
PSA-2026-0002: Session isolation bypass in the RStudio Server and Posit Workbench localhost port-proxy
Published November 6, 2026
Source advisory: RStudio and Posit Workbench 2026.08.0 release notesOpens in new tab
CVE: CVE-2026-121880Opens in new tab
CWE: CWE-639 (Authorization Bypass Through User-Controlled Key)
Severity: Medium (CVSS v4.0: 5.7, CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)
Affected versions: Posit Workbench and RStudio Server, all releases through 2026.07.1
Fixed version: 2026.08.0
Description
Authorization bypass in the localhost port-proxy (/p/ and /p6/ URLs) in RStudio Server and Posit Workbench through 2026.07.1 allows an authenticated user on a multi-user server to reach web applications and other services bound to 127.0.0.1 under another user's session, and to view their live rendered content and data, via a proxy URL built from the attacker's own port token and an arbitrary port number. The port token is an obfuscation measure, documented as not cryptographically secure, and the proxy does not additionally verify that the requested port belongs to the requesting user's session; target ports are found by scanning. Root-owned listeners on the same host, such as ports published by rootful Docker or by system services, are reachable the same way.
NOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access, so single-user instances are not affected. On hosts that co-locate other privileged services on localhost the impact is higher than the base score reflects, and depends on what is running and how it is configured. Setting allow-shell=false does not prevent the bypass.
Resolution
Upgrade Posit Workbench or RStudio Server to 2026.08.0 or later. Download the installer for your platform from https://posit.co/download/rstudio-server/Opens in new tab and install it over the existing one — for example, on Ubuntu or Debian:
sudo apt-get install -y ./rstudio-workbench-2026.08.0-amd64.deb
From 2026.08.0 the server verifies that the localhost port targeted by a proxied request is owned by the requesting user, and returns HTTP 403 Forbidden otherwise.
Two conditions leave an upgraded server still exposed, and both should be checked after upgrading. The rserver.conf option www-proxy-localhost-verify-port-owner=false restores the original unverified behaviour, so it must not be set. On systems where the kernel's NETLINK_SOCK_DIAG facility is unavailable the server cannot determine port ownership; it logs a warning and retains the previous behaviour, so those deployments remain affected after upgrading and need the hardening below.
No configuration workaround fully mitigates this issue on affected versions: there is no setting that restricts the port-proxy without also disabling application proxying for Shiny, Plumber, and similar applications. Deployments unable to upgrade immediately can reduce exposure by moving sensitive workloads onto dedicated hosts or per-user isolated environments rather than a shared multi-user node, by not co-locating other sensitive network services on hosts that run user sessions, and by limiting shared-server access to mutually trusted user populations.
Credit
Reported by Luiz Felipe Mol (confu53).
Security
PSA-2026-0001: Path traversal in Shiny for Python bookmark restore
Published September 14, 2026
Source advisory: GHSA-47c3-hpmg-7j6pOpens in new tab
CVE: CVE-2026-108258
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
Severity: Medium (CVSS v4.0: 6.9, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)
Affected versions: shiny (Python) 1.4.0 through 1.6.3
Fixed version: 1.6.4
Description
Opens in new tab
Path traversal vulnerability in the bookmark-restore handler in Posit Shiny for Python before 1.6.4 allows remote attackers to cause the server to read files from attacker-chosen paths via the _state_id_ query-string parameter.
NOTE: on applications configured with bookmark_store="server" and using ui.input_file(), the impact extends to disclosure of file contents; other configurations are limited to a path existence/validity probe.
Resolution
Opens in new tab
Upgrade to shiny 1.6.4 or later:
pip install --upgrade shiny
No configuration workaround fully mitigates this issue on affected versions. Deployments unable to upgrade immediately can strip the _state_id_ parameter from incoming query strings at a reverse proxy or load balancer.
Credit
Opens in new tab
Reported by @0xRenSecOpens in new tab.