{"data":{"id":"38a6b11a-eb38-450b-9a71-6200c64cfab4","title":"CVE-2024-47871: Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **insecure…","summary":"Gradio, an open-source Python package for quick prototyping, has insecure communication between its FRP (Fast Reverse Proxy) client and server when the `share=True` option is used. HTTPS is not enforced, so an attacker can intercept and read files uploaded to the Gradio server and modify responses or data passed between client and server. The exposure affects users who share Gradio demos publicly with `share=True` without proper encryption.","solution":"Upgrade to `gradio>=5`. As a workaround, avoid `share=True` in production and host Gradio applications on servers with HTTPS enabled.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-47871","publishedAt":"2024-10-11T03:15:03.187Z","cveId":"CVE-2024-47871","cweIds":["CWE-311","CWE-311"],"cvssScore":"9.1","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@< 5.0.0 (fixed: 5.0.0)"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Gradio insecure communication between FRP client and server when share=True","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00176,"epssCheckedAt":"2026-11-04T06:10:13.969Z","kevDateAdded":null,"advisoryAliases":["GHSA-279j-x4gx-hfrh"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:01.357Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-10-09T13:04:16.634Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:45:20.334Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"gradio","fixedVersion":"5.0.0","matchedVersion":"5.0.0","fixReleasedAt":"2024-10-09T13:04:16.634Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:20.181Z"}]}}