gradio@5.9.0 vulnerabilities

Python library for easily interacting with trained machine learning models

5.9.1

5 years ago

5 days ago

Known vulnerabilities in the gradio package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
H Server-side Request Forgery (SSRF) gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to no restrictions on the URL, in the `save_url_to_cache` function. An attacker can access and download local resources and sensitive information. How to fix Server-side Request Forgery (SSRF)? There is no fixed version for `gradio`.	[0,)
M Arbitrary Code Injection gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Arbitrary Code Injection due to improper check of the input, when users generate `pyi`. An attacker can execute arbitrary code by supplying crafted input. Note: This vulnerability is disputed by the maintainer because the report is about a user attacking himself. How to fix Arbitrary Code Injection? There is no fixed version for `gradio`.	[0,)
M Open Redirect gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Open Redirect via the `file` parameter. An attacker can scan and identify open ports within an internal network by discerning the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response. How to fix Open Redirect? There is no fixed version for `gradio`.	[0,)