GitHub Advisoryadvisory · PyPI

GHSA-m842-4qm8-7gpq Gradio allows users to access arbitrary files

CRITICAL Published 2024-09-25 Modified 2026-10-27 Official page ↗
Aliases
CVE-2024-1728
Ecosystem
PyPI
Packages
gradio
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2024-09-25

Affected packages

• PyPI gradio: < 4.19.2 → fixed in 4.19.2

Description

Impact This vulnerability allows users of Gradio applications that have a public link (such as on Hugging Face Spaces) to access files on the machine hosting the Gradio application. This involves intercepting and modifying the network requests made by the Gradio app to the server. Patches Yes, the problem has been patched in Gradio version 4.19.2 or higher. We have no knowledge of this exploit being used against users of Gradio applications, but we encourage all users to upgrade to Gradio 4.19.2 or higher. Fixed in: https://github.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7 CVE: https://nvd.nist.gov/vuln/detail/CVE-2024-1728

Related

Alias · CVE (1)

  • CVE-2024-1728 gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References