GitHub Advisoryadvisory · PyPI

GHSA-3qqg-pgqq-3695 Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs

MEDIUM Published 2023-06-09 Modified 2024-09-20 Official page ↗
Aliases
CVE-2023-34239
Ecosystem
PyPI
Packages
gradio
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-20
Reviewed
2023-06-09

Affected packages

• PyPI gradio: < 3.34.0 → fixed in 3.34.0

Description

Impact There are two separate security vulnerabilities here: (1) a security vulnerability that allows users to read arbitrary files on the machines that are running shared Gradio apps (2) the ability of users to use machines that are sharing Gradio apps to proxy arbitrary URLs Patches Both problems have been solved, please upgrade `gradio` to `3.34.0` or higher Workarounds Not possible to workaround except by taking down any shared Gradio apps References Relevant PRs: • https://github.com/gradio-app/gradio/pull/4406 • https://github.com/gradio-app/gradio/pull/4370

Related

Alias · CVE (1)

  • CVE-2023-34239 Gradio is an open-source Python library that is used to build machine learning and data science. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References