PT-2024-4392 · Gradio · Gradio
Published
2024-05-05
·
Updated
2025-06-17
·
CVE-2024-34510
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Gradio versions prior to 4.20
Description
The issue is related to insufficient protection of sensitive data in Gradio, a Python package for creating applications for machine learning models. This can allow a remote attacker to gain access to credentials. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.
Recommendations
For versions prior to 4.20, update to version 4.20 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data until a patch is applied. Avoid using Gradio on Windows with versions prior to 4.20 to minimize the risk of credential leakage.
Fix
Improper Encoding or Escaping of Output
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Gradio