Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
40 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modification of the base repository or secrets exfiltration. The issue affects versions up to and including '@gradio/video@0.6.12'. The flaw is present in the workflow's handling of GitHub context information, where it echoes the full name of the head repository, the head branch, and the workflow reference without adequate sanitization. This could potentially lead to the exfiltration of sensitive secrets such as 'GITHUB_TOKEN', 'COMMENT_TOKEN', and 'CHROMATIC_PROJECT_TOKEN'.
Recommended action: Upgrade to 4.29.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This CVE covers the ability of 3rd party websites to access routes and upload files to users running Gradio applications locally. For example, the malicious owners of www.dontvisitme.com could put a script on their website that uploads a large file to http://localhost:7860/upload and anyone who visits their website and has a Gradio app will now have that large file uploaded on their computer Patches Yes, the problem has been patched in Gradio version 4.19.2 or higher. We have no knowledge of this exploit being used against users of Gradio applications, but we encourage all users to upgrade to Gradio 4.19.2 or higher. Fixed in: https://github.com/gradio-app/gradio/commit/84802ee6a4806c25287344dce581f9548a99834a CVE: https://nvd.nist.gov/vuln/detail/CVE-2024-1727
Recommended action: Upgrade to 4.19.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Gradio before 4.20 allows credential leakage on Windows.
Recommended action: Upgrade to 4.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Component Server in Gradio before 4.13 does not properly consider isserverfn for functions.
Recommended action: Upgrade to 4.13.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in gradio-app/gradio, where the /componentserver endpoint improperly allows the invocation of any method on a Component class with attacker-controlled arguments. Specifically, by exploiting the moveresourcetoblockcache() method of the Block class, an attacker can copy any file on the filesystem to a temporary directory and subsequently retrieve it. This vulnerability enables unauthorized local file read access, posing a significant risk especially when the application is exposed to the internet via launch(share=True), thereby allowing remote attackers to read files on the host machine. Furthermore, gradio apps hosted on huggingface.co are also affected, potentially leading to the exposure of sensitive information such as API keys and credentials stored in environment variables.
Recommended action: Upgrade to 4.13.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
Recommended action: Upgrade to 4.10.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the /proxy route. Attackers can exploit this vulnerability by manipulating the self.replicaurls set through the X-Direct-Url header in requests to the / and /config routes, allowing the addition of arbitrary URLs for proxying. This flaw enables unauthorized proxying of requests and potential access to internal endpoints within the Hugging Face space. The issue arises from the application's inadequate checking of safe URLs in the buildproxyrequest function.
Recommended action: Upgrade to 4.18.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This security policy is with regards to a timing attack that allows users of Gradio apps to potentially guess the password of password-protected Gradio apps. This relies on the fact that string comparisons in Python terminate early, as soon as there is a string mismatch. Because Gradio apps are, by default, not rate-limited, a user could brute-force millions of guesses to figure out the correct username and password. Patches Yes, the problem has been patched in Gradio version 4.19.2 or higher. We have no knowledge of this exploit being used against users of Gradio applications, but we encourage all users to upgrade to Gradio 4.19.2 or higher. Fixed in: https://github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b
Recommended action: Upgrade to 4.19.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.
Recommended action: Upgrade to 4.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Older versions of gradio contained a vulnerability in the /file route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with share=True, or on Hugging Face Spaces) if they knew the path of files to look for. This was not possible through regular URLs passed into a browser, but it was possible through the use of programmatic tools such as curl with the --pass-as-is flag. Furthermore, the /file route in Gradio apps also contained a vulnerability that made it possible to use it for SSRF attacks. Both of these vulnerabilities have been fixed in gradio==4.11.0
Recommended action: Upgrade to 4.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository gradio-app/gradio prior to main.
Recommended action: Upgrade to 4.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact There are two separate security vulnerabilities here: (1) a security vulnerability that allows users to read arbitrary files on the machines that are running shared Gradio apps (2) the ability of users to use machines that are sharing Gradio apps to proxy arbitrary URLs Patches Both problems have been solved, please upgrade gradio to 3.34.0 or higher Workarounds Not possible to workaround except by taking down any shared Gradio apps References Relevant PRs: https://github.com/gradio-app/gradio/pull/4406 https://github.com/gradio-app/gradio/pull/4370
Recommended action: Upgrade to 3.34.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This is a vulnerability which affects anyone using Gradio's share links (i.e. creating a Gradio app and then setting share=True) with Gradio versions older than 3.13.1. In these older versions of Gradio, a private SSH key is sent to any user that connects to the Gradio machine, which means that a user could access other users' shared Gradio demos. From there, other exploits are possible depending on the level of access/exposure the Gradio app provides. Patches The problem has been patched. Ideally, users should upgrade to gradio==3.19.1 or later where the FRP solution has been properly tested. Credit Credit to Greg Sadetsky and Samuel Tremblay-Cossette for alerting the team
Recommended action: Upgrade to 3.13.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The gradio library has a flagging functionality which saves input/output data into a CSV file on the developer's computer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel opens such a file, then it automatically runs these commands, which could lead to arbitrary commands running on the user's computer. Patches The problem has been patched as of 2.8.11, which escapes the data saved to the csv with single quotes. Workarounds If you are using an older version of gradio, don't open csv files generated by gradio with Excel or similar spreadsheet programs.
Recommended action: Upgrade to 2.8.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces using gradio<2.4.8. Because of the way that static files were being served, someone who generated a public Gradio link and shared it with others would potentially be exposing the files on the computer that generated the link, while the link was active. An attacker would be able to view the contents of a file on the computer if they knew the exact relative filepath. We do not have any evidence that this was ever exploited, but we treated the issue seriously and immediately took steps to mitigate it (see below) Response 1. We worked with @haby0 to immediately patch the issue and released a new version, gradio 2.5.0, within 24 hours of the issue being brought to our attention 2. We enabled a notification that is printed to anyone using an older version of gradio telling them to upgrade (see screenshot below) 3. We expanded our test suite to test for this vulnerability ensuring that our…
Recommended action: Upgrade to 2.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.