Gradio Vulnerability: Command Injection in 'test-functional.yml' Workflow

CVE-2024-4253

What is CVE-2024-4253?

A command injection vulnerability is identified within the Gradio app's 'test-functional.yml' workflow. This flaw stems from inadequate sanitization of command elements, allowing for unauthorized modifications to the base repository and potential exfiltration of sensitive secrets such as 'GITHUB_TOKEN', 'COMMENT_TOKEN', and 'CHROMATIC_PROJECT_TOKEN'. The issue primarily affects versions up to and including '@gradio/[email protected]'. The vulnerability arises from the way GitHub context information is processed, echoing sensitive repository details without appropriate neutralization, which could be exploited by malicious actors.

References