Command Injection in gradio-app/gradio via deploy+test-visual.yml workflow

CVE-2024-1540

What is CVE-2024-1540?

A command injection vulnerability exists in the deploy+test-visual.yml workflow of Gradio. This vulnerability is attributed to improper neutralization of special elements used in command execution. Attackers can exploit this flaw to execute unauthorized commands, which may lead to unauthorized modifications of the base repository along with potential secrets exfiltration. The risk arises from the unsafe handling of GitHub context information, where expressions within ${{ }} are evaluated and substituted before the execution of underlying scripts. To mitigate this issue, it is essential to ensure that untrusted input values are directed to intermediate environment variables, preventing them from directly influencing script generation.

References