{"data":{"id":"1bc2d485-546d-4016-bfe8-45c4b3fff0e0","title":"CVE-2024-47872: Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **Cross-Site…","summary":"CVE-2024-47872 affects Gradio, an open-source Python package for quick prototyping, on any server that allows file uploads. Authenticated users can upload HTML, JavaScript, or SVG files containing malicious scripts, which execute in other users' browsers when those files are downloaded or viewed, enabling unauthorized actions or theft of session information.","solution":"Users are advised to upgrade to `gradio>=5`. As a workaround, restrict uploads to non-executable file types such as images or text, and implement server-side validation that sanitizes uploaded files, ensuring HTML, JavaScript, and SVG files are properly handled or rejected before being stored or displayed.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-47872","publishedAt":"2024-10-11T03:15:03.303Z","cveId":"CVE-2024-47872","cweIds":["CWE-79"],"cvssScore":"5.4","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@< 5.0.0 (fixed: 5.0.0)"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Gradio cross-site scripting through uploaded HTML, JavaScript, or SVG files","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00277,"epssCheckedAt":"2026-11-04T18:09:14.876Z","kevDateAdded":null,"advisoryAliases":["GHSA-gvv6-33j7-884g"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:00.845Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-10-09T13:04:16.634Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:45:19.538Z","capecIds":["CAPEC-198","CAPEC-86"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"gradio","fixedVersion":"5.0.0","matchedVersion":"5.0.0","fixReleasedAt":"2024-10-09T13:04:16.634Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:19.386Z"}]}}