Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading files

ImpactThis CVE covers the ability of 3rd party websites to access routes and upload files to users running Gradio applications locally. For example, the malicious owners of www.dontvisitme.com could put a script on their website that uploads a large file to http://localhost:7860/upload and anyone...

CVE-2024-1727

Summary: CVE-2024-1727 describes a CSRF vulnerability in the Gradio application (gradio-app/gradio) that can allow an attacker to trigger unauthorized uploads of large files to a victim’s local Gradio server (gradio/routes.py), potentially exhausting disk space and causing a denial of service. Im...

CVE-2024-1727 CSRF Vulnerability in gradio-app/gradio

A Cross-Site Request Forgery CSRF vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an unauthorized file upload to the victim's server, an attacker can deplete...