CVE-2024-0964

CRITICAL

LFI in Gradio

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-0964 has a selected CVSS score of 9.4 (critical).

Description

A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 6, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

gradio-app/gradio

Browse gradio-app / gradio-app/gradio

Default status: unknown

CVE ListBefore xaffected
Through *affected

gradio

Browse PyPI / gradio
GitHub AdvisoryBefore 4.9.0 · Fixed in 4.9.0affected

References

5