gradio-app

50 results · Feed

• High 8.6
  CVE-2024-1540 Public exploit

  Command Injection in gradio-app/gradio via deploy+test-visual.yml workflow

  A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special elements used in a command. This vulnerability allows attackers to execute unauthorized commands, po…

  gradio-app gradio-app/gradio
  Mar 27, 2024
• High 7.3
  CVE-2024-2206

  SSRF Vulnerability in gradio-app/gradio

  An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the `/proxy` route. Attackers can exploit this vulnerability by manipulating the `self.replica_urls` set through the `X-Direct-Url` header in request…

  gradio-app gradio-app/gradio gradio PyPI
  Mar 27, 2024
• Medium 4.3
  CVE-2024-1727

  CSRF Vulnerability in gradio-app/gradio

  A Cross-Site Request Forgery (CSRF) vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an unauthorized file upload to the …

  gradio-app gradio-app/gradio gradio PyPI
  Mar 21, 2024
• High 7.5
  CVE-2024-0964

  LFI in Gradio

  A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.

  gradio-app gradio-app/gradio gradio PyPI
  Feb 5, 2024
• Medium 5.6
  CVE-2023-51449 Scanner template EPSS 28%

  Make the `/file` secure against file traversal attacks

  Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which…

  gradio-app gradio gradio PyPI
  Dec 22, 2023
• Critical 9.6
  CVE-2023-6572 Public exploit

  Command Injection in gradio-app/gradio

  Command Injection in GitHub repository gradio-app/gradio prior to main.

  gradio-app gradio-app/gradio gradio PyPI
  Dec 14, 2023
• High 7.3
  CVE-2023-34239

  Unfiltered paths in gradio

  Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restrict file access to users. Additionally Gradio does not properly restrict the what URLs are proxied. …

  gradio-app gradio gradio PyPI
  Jun 7, 2023
• Medium 5.4
  CVE-2023-25823

  Gradio contains Use of Hard-coded Credentials

  Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-coded Credentials. When using Gradio's share links (i.e. creating a Gradio app and then setting `share=…

  gradio-app gradio gradio PyPI
  Feb 23, 2023
• High 8.8
  CVE-2022-24770

  Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging

  `gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which …

  gradio-app gradio gradio PyPI
  Mar 17, 2022
• High 7.7
  CVE-2021-43831 Scanner template

  Files on the host computer can be accessed from the Gradio interface

  Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces. File paths are not restricted and users w…

  gradio-app gradio gradio PyPI
  Dec 15, 2021