<p>Upgrade <code>gradio</code> to version 2.8.11 or higher.</p>

Improper Neutralization of Formula Elements in a CSV File Affecting gradio package, versions [,2.8.11)

Threat Intelligence

0.21% (60^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-PYTHON-GRADIO-2429584
published 18 Mar 2022
disclosed 18 Mar 2022
credit haby0

Report a new vulnerability Found a mistake?

Introduced: 18 Mar 2022

CVE-2022-24770 Open this link in a new tab CWE-1236 Open this link in a new tab

How to fix?

Upgrade gradio to version 2.8.11 or higher.

Overview

gradio is a Python library for easily interacting with trained machine learning models

Affected versions of this package are vulnerable to Improper Neutralization of Formula Elements in a CSV File via the flagging functionality that allows a user to save arbitrary text into the CSV file, such as commands. This vulnerability might be exploited when a program like MS Excel opens such a file, and automatically runs these commands.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Local
Attack Complexity (AC)

Low
Privileges Required (PR)

None
User Interaction (UI)

Required

Scope (S)

Unchanged

Confidentiality (C)

Low
Integrity (I)

High
Availability (A)

High