PT-2024-28403 · Gradio · Gradio

Kmulka-Bloomberg · Published 2024-07-01 · Updated 2025-06-27 · CVE-2024-39236

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gradio version 4.36.1

Description A code injection issue was discovered in Gradio via the component /gradio/component meta.py. This issue is triggered by a crafted input. Note that the supplier disputes this report as it involves a user attacking themselves.

Recommendations For Gradio version 4.36.1, consider disabling the component /gradio/component meta.py as a temporary workaround until a patch is available. Restrict access to this component to minimize the risk of exploitation. Avoid using crafted inputs that could trigger this issue until it is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-39236

GHSA-9V2F-6VCG-3HGV

PYSEC-2024-274

Affected Products

Gradio

References · 13

• 🔥 https://github.com/Aaron911/PoC/blob/main/Gradio.md · Exploit
• https://github.com/gradio-app/gradio/issues/8853 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39236 · Security Note
• https://osv.dev/vulnerability/GHSA-9v2f-6vcg-3hgv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39236 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-274 · Vendor Advisory
• https://github.com/gradio-app/gradio/issues/8853#issuecomment-2239858984 · Note
• https://t.me/cvenotify/88450 · Telegram Post
• https://twitter.com/cracbot/status/1809105090701373461 · Twitter Post
• https://t.me/cvenotify/126932 · Telegram Post
• https://t.me/cvenotify/86976 · Telegram Post
• https://t.me/cvenotify/84949 · Telegram Post
• https://github.com/advisories/GHSA-9v2f-6vcg-3hgv · Note