CVE-2024-34511Medium· 6.5▾ SunlitGradio's Component Server does not properly consider` _is_server_fn` for functions
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
Component Server in Gradio before 4.13 does not properly consider _is_server_fn for functions.
gradio < 4.13.0Upgrade to a patched release:
gradio 4.13.0Connected by shared product, vendor, weakness, or advisory.
CVE-2024-1561High· 7.5gradio vulnerable to Path Traversal
CVE-2023-6572Critical· 9.6Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability
CVE-2023-51449High· 8.6Gradio makes the `/file` secure against file traversal and server-side request forgery attacks
CVE-2023-25823Medium· 5.4Update share links to use FRP instead of SSH tunneling
CVE-2023-34239High· 7.3Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs
GHSA-26jh-r8g2-6fprMedium· 5.3Gradio's dropdown component pre-process step does not limit the values to those in the dropdown list