CVE-2024-47868 Several components’ post-process steps may allow arbitrary file leaks in Gradio

Gradio is an open-source Python package designed for quick prototyping. This is a data validation vulnerability affecting several Gradio components, which allows arbitrary file leaks through the post-processing step. Attackers can exploit these components by crafting requests that bypass expected...

CVE-2024-47164

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the bypass of directory traversal checks within the isinorequal function. This function, intended to check if a file resides within a given directory, can be bypassed with certain payloads that...

CVE-2024-47871 Insecure communication between the FRP client and server in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves insecure communication between the FRP Fast Reverse Proxy client and server when Gradio's share=True option is used. HTTPS is not enforced on the connection, allowing attackers to intercept and rea...

CVE-2024-47872 Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves Cross-Site Scripting XSS on any Gradio server that allows file uploads. Authenticated users can upload files such as HTML, JavaScript, or SVG files containing malicious scripts. When other users...

CVE-2024-47084 CORS origin validation is not performed when the request has a cookie in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio...

CVE-2024-47164 The `is_in_or_equal` function may be bypassed in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the bypass of directory traversal checks within the isinorequal function. This function, intended to check if a file resides within a given directory, can be bypassed with certain payloads that...

CVE-2024-47165 CORS origin validation accepts the null origin in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhostaliases variable includes "null" as a valid origin. This allows attackers to make unauthoriz...

CVE-2024-47166 One-level read path traversal in `/custom_component` in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a one-level read path traversal in the /customcomponent endpoint. Attackers can exploit this flaw to access and leak source code from custom Gradio components by manipulating the file path in the...

CVE-2024-47168 The `enable_monitoring` flag set to `False` does not disable monitoring in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enablemonitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access th...

CVE-2024-47168

The CVE relates to Gradio, a Python lib for ML prototyping. The enable_monitoring flag does not disable monitoring, so the /monitoring endpoint can be accessed by unauthorized users and can expose sensitive analytics. This data exposure occurs even when monitoring is intended to be off. Affected:...

Malicious code in fake-usreagent (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f4baefb66829fd54eeb9a557917c302ba8588059ca8483d1a56b06518d7638d4 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

Malicious code in ua-agent-generator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7294a5078d47d2797cf31931252b823374b648a48534bc14b59cd73195cfe2f1 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

Malicious code in user-rand-agnt-user (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e5b1f023c010c55afb11b349054c1180303197e0d411176b276d26574d891702 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

Malicious code in user-random-agent-user (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 593686652ece19b8d2d79006659b8392c347442f9a8403ef1b9f8a8bfa232925 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

Malicious code in crypto-regex-checker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a849790638e062a67e51026ebcd7d23b06a5cb901a1b74ce74bcf09762511538 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

MAL-2024-11564 Malicious code in crypto-format-checking (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a95b535a5d579db23cf10d4a9897278238afb3093600235b1f39ddf2cca74600 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

MAL-2024-11599 Malicious code in gen-user-random-agent (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4e261c26a73604aac348f2df96e5b12b0817010a9a1bbc48ddfbe309915c697b Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

Malicious code in agent-user-generate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 514af1dfd929068fabc7527812b99ec6a287c3601d7cf4ed1d29c55e74339fac Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

MAL-2024-11739 Malicious code in user-rand-agnt-user (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e5b1f023c010c55afb11b349054c1180303197e0d411176b276d26574d891702 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...

Malicious code in crypto-regex-gener (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3236b2ded0bd62e3958fa1c6257142248c46b75e64cdd0a90edd82ffba869335 Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...