{"action":"Upgrade shiny to 1.6.4 or later.","affected":[{"fixed":"1.6.4","introduced":"1.4.0"}],"component":"shiny","cve_ids":["CVE-2026-108258"],"ecosystem":"PyPI","epss":0.00358,"exploited":false,"fixed_versions":["1.6.4"],"ghsa_id":"GHSA-47c3-hpmg-7j6p","id":"tcs_01M5KHB6MVE6KD0X5PXH8ANH9K","modified_at":"2026-10-15T14:45:13.471383484Z","published_at":"2026-10-15T10:22:55.128915Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4300","https://github.com/posit-dev/py-shiny/security/advisories/GHSA-47c3-hpmg-7j6p","https://github.com/posit-dev/py-shiny/commit/1d8ecb46cbc9621b7dc8812111d26692e086b376","https://github.com/posit-dev/py-shiny","https://github.com/posit-dev/py-shiny/releases/tag/v1.6.4","https://pypi.org/project/shiny","https://github.com/advisories/GHSA-47c3-hpmg-7j6p","https://nvd.nist.gov/vuln/detail/CVE-2026-108258"],"severity":{"label":"medium","score":6.9},"sources":[{"source":"osv","source_id":"PYSEC-2026-4300","url":"https://osv.dev/vulnerability/PYSEC-2026-4300"},{"source":"nvd","source_id":"CVE-2026-108258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108258"}],"summary":"Shiny for Python has path traversal in bookmark restore"}