gradio-app

Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py.

gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component.

A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.

Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function.

Gradio is an open-source Python package designed for quick prototyping.

A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae.

A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special elements used in a command.

Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function.

A Denial of Service (DoS) vulnerability was discovered in the file upload feature of gradio-app/gradio version 0.39.1.

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component.

A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack.

A vulnerability in the file upload process of gradio-app/gradio version @gradio/[email protected] allows for a Denial of Service (DoS) attack.

A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25.

An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of any method on a `Component` class with attacker-controlled arguments.

Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across all users in the rev…

An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the `/proxy` route.

Gradio is an open-source Python package designed for quick prototyping.

A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function.

The 'deploy-website.yml' workflow in the gradio-app/gradio repository, specifically in the 'main' branch, is vulnerable to secrets exfiltration due to improper authorization.

A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS.

Gradio is an open-source Python package designed to enable quick builds of a demo or web application.

In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability.

A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py.

An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network.

A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1.