PT-2024-40012 · Gradio · Gradio

Published 2024-10-10 · Updated 2024-10-10

Positive Technologies (AI Summary)

CVSS v4.0

2.7

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Gradio versions prior to 5.0

Description This issue is a data validation problem in the Gradio Dropdown component's pre-processing step. It allows attackers to bypass input constraints by sending custom requests with arbitrary values, even when the allow custom value parameter is set to False. This can lead to more critical security issues when combined with other vulnerabilities.

Recommendations For versions prior to 5.0, upgrade to the latest version to resolve the problem. As a temporary workaround, consider adding manual validation in the prediction function to check received values against allowed dropdown values before processing them.

Fix

Related Identifiers

GHSA-26JH-R8G2-6FPR

Affected Products

Gradio

References · 3

• https://osv.dev/vulnerability/GHSA-26jh-r8g2-6fpr · Vendor Advisory
• https://github.com/gradio-app/gradio · Note
• https://github.com/gradio-app/gradio/security/advisories/GHSA-26jh-r8g2-6fpr · Note