Technical impact
Bokeh WebSocket Hijacking: Versions 3.8.1 and earlier contain flawed origin validation. An attacker can register a sub‑domain that matches the allow‑list and lure users to that site. The malicious page then opens a WebSocket to the Bokeh server. Because the Origin header is incorrectly accepted, the server permits the connection and handshakes, giving the attacker the same privileges as the victim, allowing data retrieval or manipulation of visualizations. This flaw behaves as a malicious use of the server’s interface rather than a classic code‑execution vector.
Affected Systems
Vendor: Bokeh bokeh. Product: the Bokeh interactive visualization library for Python. Affected releases include all versions up to and including 3.8.1. The issue is resolved in 3.8.2 and later releases.
Risk and Exploitability
Severity is rated 4.5 on CVSS v3.1, confirming a moderate overall risk. EPSS shows less than 1% probability of exploitation, indicating that while the vulnerability exists, it is not frequently targeted. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to host a malicious website that matches the server’s origin allow‑list and persuade an authenticated user to visit it. Once the victim browses that page, a WebSocket handshake is performed that bypasses the server’s filter, enabling unauthorized use of the server. No direct code‑execution capability is disclosed; the impact is primarily unauthorized data access or manipulation.
Github GHSA