Is bokeh affected by CVE-2026-21883?

PyPI bokeh is affected in <3.8.2.

Is CVE-2026-21883 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.2%.

medium

CVE-2026-21883

Q: Is CVE-2026-21883 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.2%.

PyPI · bokeh

Summary

Bokeh server applications have Incomplete Origin Validation in WebSockets

Severity: medium
EPSS: 0.2% (p5)
Also known as: GHSA-793v-589g-574v
Published: 2026-01-06

References

https://github.com/bokeh/bokeh/security/advisories/GHSA-793v-589g-574v
https://nvd.nist.gov/vuln/detail/CVE-2026-21883
https://github.com/bokeh/bokeh/commit/cedd113b0e271b439dce768671685cf5f861812e

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.