PYSEC-2025-93

gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue CVE-2024-4941. This vulnerability allows unauthenticated users to access arbitrary files on the server by uploading a speciall...

CVE-2024-4941

A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the postprocess function within gradio/components/jsoncomponent.py, where a user-controlled string is parsed as JSON. If the parsed JSON...

trubrics (>=1.1.0, <=1.1.1) potentially affected by CVE-2024-4941 via gradio (3.8.1)

gradio PYPI version 3.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - trubrics =1.1.0, =1.1.1 Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...

pynami (>=0.0.1, <=0.0.2) potentially affected by CVE-2024-4941 via gradio (3.17.0)

gradio PYPI version 3.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - pynami =0.0.1, =0.0.2 Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...

customintents (>=0.8.0, <=1.0.0) potentially affected by CVE-2024-4941 via gradio (3.16.2)

gradio PYPI version 3.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - customintents =0.8.0, =1.0.0 Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...

gcvit (>=1.0.4, <=1.0.9) potentially affected by CVE-2024-4941 via gradio (3.1.0)

gradio PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gcvit =1.0.4, =1.0.9 Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...

artcraft (>=0.0.0, <=0.0.23), maestror (0.1.0) potentially affected by CVE-2024-4941 via gradio (3.41.2)

gradio PYPI version 3.41.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - artcraft =0.0.0, =0.0.23 - maestror 0.1.0 Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...

pynami (>=0.0.3, <=0.0.5) potentially affected by CVE-2024-4941 via gradio (3.19.1)

gradio PYPI version 3.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - pynami =0.0.3, =0.0.5 Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...

yolov2keras (>=0.0.2, <=0.0.6) potentially affected by CVE-2024-4941 via gradio (3.45.2)

gradio PYPI version 3.45.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - yolov2keras =0.0.2, =0.0.6 Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...

diffuzers (>=0.0.2, <=0.0.6), starwhale (>=0.3.5, <=0.4.9) potentially affected by CVE-2024-4941 via gradio (3.15.0)

gradio PYPI version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - diffuzers =0.0.2, =0.3.5, =0.4.9 Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...

langs-vall (>=0.0.1, <=0.0.18) potentially affected by CVE-2024-4941 via gradio (3.47.1)

gradio PYPI version 3.47.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - langs-vall =0.0.1, =0.0.18 Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...

academic-chatgpt (>=0.3.0, <=0.4.1), agentverse (>=0.1.5, <=0.1.8) +46 more potentially affected by CVE-2024-4941 via gradio (3.50.2)

gradio PYPI version 3.50.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - academic-chatgpt =0.3.0, =0.1.5, =0.0.4, =0.8.11, =0.1.0, =0.1.3, =1.1.0, =1.2.1 and more Source cves: CVE-2024-4941 Source advisory:...

chatarena (>=0.1.9, <=0.1.10) potentially affected by CVE-2024-4941 via gradio (3.20.0)

gradio PYPI version 3.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - chatarena =0.1.9, =0.1.10 Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...

musicaiz (>=0.0.1, <=0.0.2) potentially affected by CVE-2024-4941 via gradio (3.0.15)

gradio PYPI version 3.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - musicaiz =0.0.1, =0.0.2 Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...

africanwhisper (>=0.2.1, <=0.9.0), agentx (>=0.0.6, <=0.0.27) +41 more potentially affected by CVE-2024-4941 via gradio (>=4.0.0b15, <=4.31.0)

gradio PYPI version =4.0.0b15, =0.2.1, =0.0.6, =0.4.0, =0.1.0, =0.1.2, =0.1.1, =0.5.0, =0.0.1, =1.0.0, =0.0.5, =0.3.1, =0.3.3 and more Source cves: CVE-2024-4941 Source advisory: GHSA-6V6G-J5FQ-HPVW...

customintents (>=0.7.3, <=0.7.6) potentially affected by CVE-2024-4941 via gradio (3.16.1)

gradio PYPI version 3.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - customintents =0.7.3, =0.7.6 Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...

querytograph (>=0.0.1, <=0.0.5), tumourkit (>=0.6.0, <=0.10.1) potentially affected by CVE-2024-4941 via gradio (3.26.0)

gradio PYPI version 3.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - querytograph =0.0.1, =0.6.0, =0.10.1 Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...

autotrain-advanced (>=0.6.32, <=0.7.63) potentially affected by CVE-2024-4941 via gradio (3.41.0)

gradio PYPI version 3.41.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - autotrain-advanced =0.6.32, =0.7.63 Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...

harmonai-tools (>=0.0.6, <=0.0.7), stable-audio-tools (>=0.0.7, <=0.0.10) potentially affected by CVE-2024-4941 via gradio (3.42.0)

gradio PYPI version 3.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - harmonai-tools =0.0.6, =0.0.7, =0.0.10 Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...

africanwhisper (>=0.2.1, <=0.9.0), agentx (>=0.0.6, <=0.0.27) +41 more potentially affected by CVE-2024-4941 via gradio (>=4.0.0b15, <=4.31.0)

gradio PYPI version =4.0.0b15, =0.2.1, =0.0.6, =0.4.0, =0.1.0, =0.1.2, =0.1.1, =0.5.0, =0.0.1, =1.0.0, =0.0.5, =0.3.1, =0.3.3 and more Source cves: CVE-2024-4941 Source advisory: OSV:GHSA-6V6G-J5FQ-HPVW...