{"data":{"id":"56b02279-06b2-41b5-8ca8-8fd5ce096507","title":"CVE-2024-1561: An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation…","summary":"The /component_server endpoint in gradio-app/gradio lets callers invoke any method on a Component class with attacker-controlled arguments. Using the move_resource_to_block_cache() method of the Block class, an attacker can copy any file on the filesystem to a temporary directory and then retrieve it, enabling unauthorized local file read. The flaw poses a significant risk when apps are exposed via launch(share=True), and gradio apps hosted on huggingface.co are also affected, potentially exposing API keys and credentials stored in environment variables.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-1561","publishedAt":"2024-04-16T04:15:08.887Z","cveId":"CVE-2024-1561","cweIds":["CWE-29"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@< 4.13.0 (fixed: 4.13.0)"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["Gradio","huggingface.co"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Gradio local file read through /component_server endpoint","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.09314,"epssCheckedAt":"2026-11-04T06:10:14.970Z","kevDateAdded":null,"advisoryAliases":["GHSA-g9cj-cfpp-4g2x"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:13.802Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-01-05T00:06:11.671Z","daysToFix":-102,"fixCheckedAt":"2026-10-29T21:46:09.257Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"gradio","fixedVersion":"4.13.0","matchedVersion":"4.13.0","fixReleasedAt":"2024-01-05T00:06:11.671Z","daysToFix":-102,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:09.107Z"}]}}