gradio-app/gradio vulnerabilities
12 known vulnerabilities in gradio-app/gradio from Gradio-app. 12 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
gradio-app/gradio: Uncontrolled Resource Consumption
A Denial of Service (DoS) vulnerability was discovered in the file upload feature of gradio-app/gradio version 0.39.1. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an exc
- 7.5 High severity
gradio-app/gradio: Allocation of Resources Without Limits or Throttling
A vulnerability in the file upload process of gradio-app/gradio version @gradio/[email protected] allows for a Denial of Service (DoS) attack. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously
- 8.2 High severity
gradio-app/gradio: Path Traversal: '..filename'
A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the
- 7.5 High severity
gradio-app/gradio: Inefficient Regular Expression Complexity
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular expression `^(?:\s*now\
- 7.5 High severity
gradio-app/gradio: Undefined Behavior for Input to API
A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process input values, which can accept compressed files. An attacker can exploit this by uploading a malicious
- 7.5 High severity
gradio-app/gradio: Improper Limitation of a Pathname to a Restricted Directory
A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the `postprocess()` function within `gradio/components/json_component.py`, where a user-controlled s
- 8.6 High severity
gradio-app/gradio: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and e
- 7.1 High severity
gradio-app/gradio: Invocation of Process Using Visible Sensitive Information
The 'deploy-website.yml' workflow in the gradio-app/gradio repository, specifically in the 'main' branch, is vulnerable to secrets exfiltration due to improper authorization. The vulnerability arises from the workflow's explicit checkout and execution of code
- 9.1 Critical severity
gradio-app/gradio: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modif
- 7.5 High severity
gradio-app/gradio: Path Traversal: '..filename'
An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of any method on a `Component` class with attacker-controlled arguments. Specifically, by exploiting the `move_resource_to_block_cache()` meth
- 7.5 High severity
gradio-app/gradio: Improper Limitation of a Pathname to a Restricted Directory
gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH key
- 8.2 High severity
gradio-app/gradio: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special elements used in a command. This vulnerability allows attackers to execute unauthorized commands, pot