{"action":"Upgrade shiny to 1.6.4 or later.","affected":[{"fixed":"1.6.4","introduced":"1.4.0"}],"component":"shiny","cve_ids":["CVE-2026-108258"],"ecosystem":"PyPI","epss":0.00357,"exploited":false,"fixed_versions":["1.6.4"],"ghsa_id":"GHSA-47c3-hpmg-7j6p","id":"tcs_01M5KEXF8K9RFVPTS3XYTSQGC7","modified_at":"2026-10-15T14:56:16.567885576Z","published_at":"2026-10-09T20:56:37Z","references":["https://osv.dev/vulnerability/GHSA-47c3-hpmg-7j6p","https://github.com/posit-dev/py-shiny/security/advisories/GHSA-47c3-hpmg-7j6p","https://github.com/posit-dev/py-shiny/commit/1d8ecb46cbc9621b7dc8812111d26692e086b376","https://github.com/posit-dev/py-shiny","https://github.com/posit-dev/py-shiny/releases/tag/v1.6.4"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-47c3-hpmg-7j6p","url":"https://osv.dev/vulnerability/GHSA-47c3-hpmg-7j6p"}],"summary":"Shiny for Python has path traversal in bookmark restore"}