Advisory details:
pypa / gradio/PYSEC-2021-873
| Advisory ID | pypa/gradio/PYSEC-2021-873 |
| Aliases |
CVE-2021-43831
GHSA-rhq2-3vr9-6mcr PYSEC-2021-873 |
| Summary | Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces. File paths are not restricted and users who receive a Gradio link can access any files on the host computer if they know the file names or file paths. This is limited only by the host operating system. Paths are opened in read only mode. The problem has been patched in gradio 2.5.0. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| There are no known severity scores. | ||
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/gradio-app/gradio/commit/41bd3645bdb616e1248b2167ca83636a2653f781 | ||
| https://github.com/gradio-app/gradio/security/advisories/GHSA-rhq2-3vr9-6mcr |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.