GoogleOSV:GHSA-XCGP-R7R8-2HC9

HistoryMar 27, 2024 - 6:32 p.m.

Gradio's CI vulnerable to Command Injection

2024-03-2718:32:38

Google

osv.dev

gradio

command injection

vulnerability

fixed

software

8.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Previously, it was possible to exfiltrate secrets in Gradio’s CI, but this is now fixed.

CPENameOperatorVersion
gradioeq1.5.0
gradioeq4.7.1
gradioeq4.12.0
gradioeq2.9b13
gradioeq3.45.0b13
gradioeq2.3.0b99
gradioeq2.9.0b6
gradioeq0.1.6
gradioeq2.4.7b8
gradioeq3.1.4b4

Name	Operator	Version
gradio	eq	1.5.0
gradio	eq	4.7.1
gradio	eq	4.12.0
gradio	eq	2.9b13
gradio	eq	3.45.0b13
gradio	eq	2.3.0b99
gradio	eq	2.9.0b6
gradio	eq	0.1.6
gradio	eq	2.4.7b8
gradio	eq	3.1.4b4

Rows per page:

1-10 of 5131

References

github.com/gradio-app/gradio

github.com/gradio-app/gradio/commit/d56bb28df80d8db1f33e4acf4f6b2c4f87cb8b28

huntr.com/bounties/0e39e974-9a66-476f-91f5-3f37abb03d77

nvd.nist.gov/vuln/detail/CVE-2024-1540