Local File Inclusion Vulnerability in gradio-app/gradio version 4.25

CVE-2024-4941

What is CVE-2024-4941?

A local file inclusion vulnerability affects the JSON component of Gradio version 4.25, originating from inadequate input validation in the postprocess() function found in gradio/components/json_component.py. The flaw allows a user-controlled string to be parsed as JSON, which, if it contains a path key, leads to the movement of the associated file into a temporary directory. This is performed by the processing_utils.move_files_to_cache() function, which traverses the provided object in search of a dictionary containing a path key. Consequently, an attacker can exploit this weakness to access files on the remote system, presenting a notable security threat.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References