{"data":{"id":"5c1f7ec6-692e-4834-b038-72faa2d28cfa","title":"CVE-2024-4253: A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the…","summary":"CVE-2024-4253 is a command injection flaw in the 'test-functional.yml' workflow of the gradio-app/gradio repository. The workflow echoes the head repository full name, head branch and workflow reference without adequate sanitization, which allows unauthorized modification of the base repository or exfiltration of secrets such as 'GITHUB_TOKEN', 'COMMENT_TOKEN' and 'CHROMATIC_PROJECT_TOKEN'. The issue affects versions up to and including '@gradio/video@0.6.12'.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-4253","publishedAt":"2024-06-04T12:15:10.863Z","cveId":"CVE-2024-4253","cweIds":["CWE-78"],"cvssScore":"9.1","cvssSeverity":"critical","severity":"critical","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"gradio-app/gradio command injection in test-functional.yml workflow","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01704,"epssCheckedAt":"2026-11-04T06:10:15.237Z","kevDateAdded":null,"advisoryAliases":["GHSA-r897-wrpm-h4vw"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-29T06:09:43.475Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}