CVE-2026-85183

Taipy's bundled socket.io server is configured with a wildcard CORS origin alongside the credentials flag, allowing any web page to open credentialed WebSocket connections to a running Taipy application (an origin validation error, CWE-1385). The attack is triggered when a victim loads an attacker-controlled web page while a Taipy application is reachable from their browser; the page silently establishes a socket.io session to the app. Because these sessions lack CSRF protection, the attacker can modify application state variables and invoke action callbacks as the victim, producing high confidentiality and integrity impact on the application and any downstream systems it interacts with (CVSS 4.0 9.3, critical). Any deployment of the Taipy Python framework is affected; the available data does not specify affected or fixed version ranges, with internet-exposed or shared-network instances most at risk. No exploitation has been reported: EPSS is 0.2% (5th percentile), the flaw is not in CISA KEV, and no public proof-of-concept is known.

What to do: Upgrade Taipy to the latest patched release from Avaiga once published (the fixed version is not stated in the available data; monitor the vendor advisory and GitHub releases). As interim mitigation, front Taipy with a reverse proxy that validates the Origin header against the application's host (or restricts the Access-Control-Allow-Origin for the socket.io endpoint) and avoid exposing Taipy apps to untrusted networks. Inventory applications where attacker-triggered state changes or action callbacks could affect downstream systems and prioritize those for remediation.