Always-Incorrect Control Flow Implementation

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to the improper handling of the enablemonitoring flag. An attacker can access sensitive application...

GHSA-HM3C-93PG-4CXW In Gradio, the `enable_monitoring` flag set to `False` does not disable monitoring

Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves data exposure due to the enablemonitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access the monitoring...

In Gradio, the `enable_monitoring` flag set to `False` does not disable monitoring

Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves data exposure due to the enablemonitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access the monitoring...

Gradio vulnerable to SSRF in the path parameter of /queue/join

Impact What kind of vulnerability is it? Who is impacted? This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This could enable...

Server-side Request Forgery (SSRF)

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the asyncsaveurltocache function in the /queue/join endpoint. An attacker can send HTTP requests to...

GHSA-576C-3J53-R9JJ Gradio vulnerable to SSRF in the path parameter of /queue/join

Impact What kind of vulnerability is it? Who is impacted? This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This could enable...

CVE-2024-47084 CORS origin validation is not performed when the request has a cookie in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio...

CVE-2024-47084

Gradio (Python library) has a CORS origin validation flaw: when a request carries a cookie, the server may not validate the origin, enabling a malicious site on the client to make unauthorized requests to a locally deployed Gradio server. Reported consequences include file uploads, token theft, a...

CVE-2024-47084 CORS origin validation is not performed when the request has a cookie in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio...

CVE-2024-47084 CORS origin validation is not performed when the request has a cookie in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio...

CVE-2024-47164 The `is_in_or_equal` function may be bypassed in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the bypass of directory traversal checks within the isinorequal function. This function, intended to check if a file resides within a given directory, can be bypassed with certain payloads that...

CVE-2024-47164

Gradio has a directory traversal bypass in the is_in_or_equal function (CVE-2024-47164). The vulnerability allows crafted paths using .. sequences to bypass directory checks and potentially access restricted files, especially where blocklist or directory access validation is used during file uplo...

CVE-2024-47164 The `is_in_or_equal` function may be bypassed in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the bypass of directory traversal checks within the isinorequal function. This function, intended to check if a file resides within a given directory, can be bypassed with certain payloads that...

CVE-2024-47164 The `is_in_or_equal` function may be bypassed in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the bypass of directory traversal checks within the isinorequal function. This function, intended to check if a file resides within a given directory, can be bypassed with certain payloads that...

CVE-2024-47165 CORS origin validation accepts the null origin in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhostaliases variable includes "null" as a valid origin. This allows attackers to make unauthoriz...

CVE-2024-47165 CORS origin validation accepts the null origin in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhostaliases variable includes "null" as a valid origin. This allows attackers to make unauthoriz...

CVE-2024-47165

CVE-2024-47165 affects Gradio (Python). When running Gradio locally, the localhost_aliases list incorrectly includes "null" as a valid origin, enabling requests from sandboxed iframes or sources with a null origin. This can lead to data theft such as authentication tokens or uploaded files for us...

CVE-2024-47165 CORS origin validation accepts the null origin in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhostaliases variable includes "null" as a valid origin. This allows attackers to make unauthoriz...

CVE-2024-47166 One-level read path traversal in `/custom_component` in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a one-level read path traversal in the /customcomponent endpoint. Attackers can exploit this flaw to access and leak source code from custom Gradio components by manipulating the file path in the...

CVE-2024-47166

Gradio CVE-2024-47166 is a one-level read path traversal in the /custom_component endpoint. An attacker can leak source code from custom Gradio components by manipulating the file path, potentially exposing proprietary or private code on publicly accessible servers. Affected: Gradio (Python packa...