Chuanhu Chat - Directory Traversal

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...

torchflare (0.2.4) potentially affected by CVE-2023-51449 via gradio (2.2.13)

gradio PYPI version 2.2.13 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - torchflare 0.2.4 Source cves: CVE-2023-51449 Source advisory: OSV:PYSEC-2023-249...

yolov2keras (>=0.0.2, <=0.0.6) potentially affected by CVE-2023-51449 via gradio (3.45.2)

gradio PYPI version 3.45.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - yolov2keras =0.0.2, =0.0.6 Source cves: CVE-2023-51449 Source advisory: OSV:PYSEC-2023-249...

picsimsearch (>=0.1.0, <=0.1.2) potentially affected by CVE-2023-51449 via gradio (3.40.1)

gradio PYPI version 3.40.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - picsimsearch =0.1.0, =0.1.2 Source cves: CVE-2023-51449 Source advisory: OSV:PYSEC-2023-249...

oobabot-plugin (0.2.3) potentially affected by CVE-2023-51449 via gradio (3.33.1)

gradio PYPI version 3.33.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - oobabot-plugin 0.2.3 Source cves: CVE-2023-51449 Source advisory: OSV:PYSEC-2023-249...

diffuzers (>=0.0.2, <=0.0.6), starwhale (>=0.3.5, <=0.4.9) potentially affected by CVE-2023-51449 via gradio (3.15.0)

gradio PYPI version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - diffuzers =0.0.2, =0.3.5, =0.4.9 Source cves: CVE-2023-51449 Source advisory: OSV:PYSEC-2023-249...

pynami (>=0.0.1, <=0.0.2) potentially affected by CVE-2023-51449 via gradio (3.17.0)

gradio PYPI version 3.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - pynami =0.0.1, =0.0.2 Source cves: CVE-2023-51449 Source advisory: OSV:PYSEC-2023-249...

artcraft (>=0.0.0, <=0.0.23), maestror (0.1.0) potentially affected by CVE-2023-51449 via gradio (3.41.2)

gradio PYPI version 3.41.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - artcraft =0.0.0, =0.0.23 - maestror 0.1.0 Source cves: CVE-2023-51449 Source advisory: OSV:PYSEC-2023-249...

gcvit (>=1.0.4, <=1.0.9) potentially affected by CVE-2023-51449 via gradio (3.1.0)

gradio PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gcvit =1.0.4, =1.0.9 Source cves: CVE-2023-51449 Source advisory: OSV:PYSEC-2023-249...

draggan (1.1.6), fast-tts (0.0.3) +2 more potentially affected by CVE-2023-51449 via gradio (3.34.0)

gradio PYPI version 3.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - draggan 1.1.6 - fast-tts 0.0.3 - kaggle-deps 0.1.0 - oobabot-plugin =0.2.0, =0.2.2 Source cves: CVE-2023-51449 Source advisory: OSV:PYSEC-2023-249...

autotrain-advanced (>=0.6.32, <=0.7.63) potentially affected by CVE-2023-51449 via gradio (3.41.0)

gradio PYPI version 3.41.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - autotrain-advanced =0.6.32, =0.7.63 Source cves: CVE-2023-51449 Source advisory: OSV:PYSEC-2023-249...

pynami (>=0.0.3, <=0.0.5) potentially affected by CVE-2023-51449 via gradio (3.19.1)

gradio PYPI version 3.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - pynami =0.0.3, =0.0.5 Source cves: CVE-2023-51449 Source advisory: OSV:PYSEC-2023-249...

go-chatgpt (0.0.5) potentially affected by CVE-2023-51449 via gradio (3.22.1)

gradio PYPI version 3.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - go-chatgpt 0.0.5 Source cves: CVE-2023-51449 Source advisory: OSV:PYSEC-2023-249...

anomalib-orobix (>=0.7.0.dev134, <=0.7.0.dev143), quadra (>=2.2.0, <=2.3.0a1) potentially affected by CVE-2023-51449 via gradio (3.0.2)

gradio PYPI version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - anomalib-orobix =0.7.0.dev134, =2.2.0, =2.3.0a1 Source cves: CVE-2023-51449 Source advisory: OSV:PYSEC-2023-249...

llmtuner (0.2.0), prompt2model (>=0.0.0a0, <=0.1.0) potentially affected by CVE-2023-51449 via gradio (3.38.0)

gradio PYPI version 3.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - llmtuner 0.2.0 - prompt2model =0.0.0a0, =0.1.0 Source cves: CVE-2023-51449 Source advisory: OSV:PYSEC-2023-249...

CVE-2023-51449 Make the `/file` secure against file traversal attacks

Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of gradio prior to 4.11.0 contained a vulnerability in the /file route which made them susceptible to file traversal...

academic-chatgpt (>=0.3.0, <=0.4.1), agentverse (>=0.1.5, <=0.1.8) +110 more potentially affected by CVE-2023-51449 via gradio (>=1.7.7, <=4.10.0)

gradio PYPI version =1.7.7, =0.3.0, =0.1.5, =0.0.2, =0.8.11, =0.7.0.dev134, =0.0.0, =0.6.14, =0.7.63 - axolotl 0.5.0 - buster-doctalk 1.0.19 and more Source cves: CVE-2023-51449 Source advisory: MEND:CVE-2023-51449...

CVE-2023-51449 Make the `/file` secure against file traversal attacks

Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of gradio prior to 4.11.0 contained a vulnerability in the /file route which made them susceptible to file traversal...

fastmonai (>=0.3.6, <=0.8.3), melotts-krqnf (0.1.2) +3 more potentially affected by CVE-2023-51449 via gradio (3.36.1)

gradio PYPI version 3.36.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - fastmonai =0.3.6, =2.1.0, =0.0.4, =0.0.5 Source cves: CVE-2023-51449 Source advisory: OSV:GHSA-6QM2-WPXQ-7QH2...

diffuzers (>=0.0.2, <=0.0.6), starwhale (>=0.3.5, <=0.4.9) potentially affected by CVE-2023-51449 via gradio (3.15.0)

gradio PYPI version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - diffuzers =0.0.2, =0.3.5, =0.4.9 Source cves: CVE-2023-51449 Source advisory: OSV:GHSA-6QM2-WPXQ-7QH2...