Snapshot 9494
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Posit PBC Trust Center Posit's Trust Center gives you one centralized place to access up-to-date security documentation, certifications, compliance details, audit reports, and subprocessor disclosures. privacy@posit.co Privacy PolicyOpens in new tab Filter by Compliance GDPR CCPA US Data Privacy SOC 2 Resources View all Policies External Information Security Policy Terms and Conditions Questionnaires Posit Team HECVAT On Prem HECVAT Shinyapps.io HECVAT Connect Cloud HECVAT View 1 more Insurance Certificate of Liability Insurance Third-Party Attestations Connect Cloud SOC 2 Report Other resources Posit B Corp Report 2025 Posit W9 Posit Banking Letter IRS Tax Residency Certificate View 1 more Controls View all Infrastructure security Unique production database authentication enforced Encryption key access restricted Unique account authentication enforced View 14 more Infrastructure security controls Organizational security Security awareness training implemented Asset disposal procedures utilized Production inventory maintained View 7 more Organizational security controls Product security Data encryption utilized Control self-assessments conducted Penetration testing performed View 2 more Product security controls Internal security procedures Continuity and Disaster Recovery plans established Continuity and Disaster Recovery plans tested Cybersecurity insurance maintained View 27 more Internal security procedures controls Data and privacy Data retention procedures established Customer data deleted upon leaving Data classification policy established Data Collected by Posit's on-prem software Posit's on-prem software does not collect any customer data Subprocessors View all 6Sense • Optimizing advertisement and retargeting, including personal and firmographic use Amazon Web Services • Cloud hosting provider Anthropic • Generative AI and machine learning models for content generation, analysis & automation (legitimate business interests) Clearbit • Reverse IP solution, custom retargeting campaigns FAQ Updates View all Security PSA-2026-0001: Path traversal in Shiny for Python bookmark restore Published September 14, 2026 Source advisory: GHSA-47c3-hpmg-7j6pOpens in new tab CVE: AWAITING CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) Severity: Medium (CVSS v4.0: 6.9, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) Affected versions: shiny (Python) 1.4.0 through 1.6.3 Fixed version: 1.6.4 Description Opens in new tab Path traversal vulnerability in the bookmark-restore handler in Posit Shiny for Python before 1.6.4 allows remote attackers to cause the server to read files from attacker-chosen paths via the _state_id_ query-string parameter. NOTE: on applications configured with bookmark_store="server" and using ui.input_file(), the impact extends to disclosure of file contents; other configurations are limited to a path existence/validity probe. Resolution Opens in new tab Upgrade to shiny 1.6.4 or later: pip install --upgrade shiny No configuration workaround fully mitigates this issue on affected versions. Deployments unable to upgrade immediately can strip the _state_id_ parameter from incoming query strings at a reverse proxy or load balancer. Credit Opens in new tab Reported by @0xRenSecOpens in new tab.