Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1tODQyLTRxbTgtN2dwcc4AA_yD

Gradio allows users to access arbitrary files

Impact

This vulnerability allows users of Gradio applications that have a public link (such as on Hugging Face Spaces) to access files on the machine hosting the Gradio application. This involves intercepting and modifying the network requests made by the Gradio app to the server.

Patches

Yes, the problem has been patched in Gradio version 4.19.2 or higher. We have no knowledge of this exploit being used against users of Gradio applications, but we encourage all users to upgrade to Gradio 4.19.2 or higher.

Fixed in: https://github.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7
CVE: https://nvd.nist.gov/vuln/detail/CVE-2024-1728

Permalink: https://github.com/advisories/GHSA-m842-4qm8-7gpq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tODQyLTRxbTgtN2dwcc4AA_yD
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 3 months ago
Updated: 3 months ago


CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-m842-4qm8-7gpq
References: Repository: https://github.com/gradio-app/gradio
Blast Radius: 33.0

Affected Packages

pypi:gradio
Dependent packages: 370
Dependent repositories: 11,837
Downloads: 6,416,528 last month
Affected Version Ranges: < 4.19.2
Fixed in: 4.19.2
All affected versions: 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.0, 0.2.1, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.4.0, 0.4.1, 0.4.2, 0.4.4, 0.5.0, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.7, 0.7.8, 0.8.0, 0.8.1, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.5, 0.9.6, 0.9.7, 0.9.8, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.8, 1.1.9, 1.2.2, 1.2.3, 1.3.0, 1.3.1, 1.3.2, 1.4.0, 1.4.2, 1.4.3, 1.4.4, 1.5.0, 1.5.1, 1.5.3, 1.5.4, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 2.0.0, 2.0.1, 2.0.2, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.1.0, 2.1.1, 2.1.2, 2.1.4, 2.1.6, 2.1.7, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.10, 2.2.11, 2.2.12, 2.2.13, 2.2.14, 2.2.15, 2.3.0, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.3.7, 2.3.9, 2.4.0, 2.4.1, 2.4.2, 2.4.4, 2.4.5, 2.4.6, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.7.0, 2.7.5, 2.8.0, 2.8.1, 2.8.2, 2.8.3, 2.8.4, 2.8.5, 2.8.6, 2.8.7, 2.8.8, 2.8.9, 2.8.10, 2.8.11, 2.8.12, 2.8.13, 2.8.14, 2.9.0, 2.9.1, 2.9.2, 2.9.3, 2.9.4, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 3.0.19, 3.0.20, 3.0.21, 3.0.22, 3.0.23, 3.0.24, 3.0.25, 3.0.26, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.3.1, 3.4.1, 3.8.1, 3.8.2, 3.9.1, 3.10.0, 3.10.1, 3.11.0, 3.12.0, 3.13.0, 3.13.1, 3.13.2, 3.14.0, 3.15.0, 3.16.0, 3.16.1, 3.16.2, 3.17.0, 3.17.1, 3.18.0, 3.19.0, 3.19.1, 3.20.0, 3.20.1, 3.21.0, 3.22.0, 3.22.1, 3.23.0, 3.24.0, 3.24.1, 3.25.0, 3.26.0, 3.27.0, 3.28.0, 3.28.1, 3.28.2, 3.28.3, 3.29.0, 3.30.0, 3.31.0, 3.32.0, 3.33.0, 3.33.1, 3.34.0, 3.35.0, 3.35.1, 3.35.2, 3.36.0, 3.36.1, 3.37.0, 3.38.0, 3.39.0, 3.40.0, 3.40.1, 3.41.0, 3.41.1, 3.41.2, 3.42.0, 3.43.0, 3.43.1, 3.43.2, 3.44.0, 3.44.1, 3.44.2, 3.44.3, 3.44.4, 3.45.0, 3.45.1, 3.45.2, 3.46.0, 3.46.1, 3.47.0, 3.47.1, 3.48.0, 3.49.0, 3.50.0, 3.50.1, 3.50.2, 4.0.0, 4.0.1, 4.0.2, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.3.0, 4.4.0, 4.4.1, 4.5.0, 4.7.0, 4.7.1, 4.8.0, 4.9.0, 4.9.1, 4.10.0, 4.11.0, 4.12.0, 4.13.0, 4.14.0, 4.15.0, 4.16.0, 4.17.0, 4.18.0, 4.19.0, 4.19.1
All unaffected versions: 4.19.2, 4.20.0, 4.20.1, 4.21.0, 4.22.0, 4.23.0, 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, 4.28.1, 4.28.2, 4.28.3, 4.29.0, 4.31.0, 4.31.1, 4.31.2, 4.31.3, 4.31.4, 4.31.5, 4.32.0, 4.32.1, 4.32.2, 4.33.0, 4.35.0, 4.36.0, 4.36.1, 4.37.1, 4.37.2, 4.38.0, 4.38.1, 4.39.0, 4.40.0, 4.41.0, 4.42.0, 4.43.0, 4.44.0, 4.44.1, 5.0.0, 5.0.1, 5.0.2, 5.1.0, 5.3.0, 5.4.0, 5.5.0, 5.6.0, 5.7.0, 5.7.1, 5.8.0, 5.9.0, 5.9.1