Permissive Cross-domain Policy with Untrusted Domains Affecting fiftyone package, versions [,1.17.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-FIFTYONE-18017905
- published19 Jul 2026
- disclosed15 Jul 2026
- creditUnknown
Introduced: 15 Jul 2026
NewCVE-2026-53656 (opens in a new tab)How to fix?
Upgrade fiftyone to version 1.17.0 or higher.
Overview
fiftyone is a FiftyOne: the open-source tool for building high-quality datasets and computer vision models
Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the Access-Control-Allow-Origin header in the server response. An attacker can access sensitive local files by enticing a user to visit a malicious website while the server is running locally, enabling unauthorized cross-origin requests to endpoints such as /media that serve files from the local filesystem. This can result in the exposure of confidential data to an external attacker.