Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

gradio-pdf

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 3.6PyPIAmendedPublished

    Arbitrary JavaScript execution due to using outdated libraries

    GHSA-4m3g-6r7g-jv4f

    Affected
    • PyPI gradio-pdf < 0.0.10
    Fixed in
    0.0.10· Vendor fix available
    Issue
    gradio-pdf projects with dependencies on the pdf.js library are vulnerable to CVE-2024-4367, which allows arbitrary JavaScript execution. PoC 1. Generate a pdf file with a malicious script in the fontmatrix. (This will run alert(‘XSS’).) poc.pdf 2. Run the app. In this PoC, I've used the demo for a simple proof. 3. Upload a PDF file containing the script. 4. Check that the script is running. Impact Malicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering. Mitigation Upgrade the pdf.js to v4.2.67, which removes the vulnerability. (or set the option isEvalSupported to false.) Reference 1. https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/ 2. https://github.com/mozilla/pdf.js/pull/18015

    Recommended action: Upgrade to 0.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →