{"data":{"id":"60ea1a9f-4810-4761-a4bd-c0ac689a9867","title":"CVE-2024-47167: Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **Server-Side…","summary":"Gradio, an open-source Python package for rapid prototyping, contains a Server-Side Request Forgery flaw in the `/queue/join` endpoint. The `async_save_url_to_cache` function lets attackers make the server send HTTP requests to user-controlled URLs, reaching internal servers or services on a local network and possibly exfiltrating data. Fetched content is stored locally, which can also let attackers upload malicious files; deployments using components such as the Video component are affected.","solution":"Upgrade to `gradio>=5`. As a workaround, disable or heavily restrict URL-based inputs to trusted domains only, implement stricter URL validation such as allowlist-based validation, and ensure local or internal network addresses cannot be requested via the `/queue/join` endpoint.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-47167","publishedAt":"2024-10-11T02:15:11.000Z","cveId":"CVE-2024-47167","cweIds":["CWE-918","CWE-918"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@< 5.0.0 (fixed: 5.0.0)"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Gradio server-side request forgery through the /queue/join endpoint","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00476,"epssCheckedAt":"2026-11-04T06:10:15.563Z","kevDateAdded":null,"advisoryAliases":["GHSA-576c-3j53-r9jj"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:05.182Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-10-09T13:04:16.634Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:45:24.968Z","capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"gradio","fixedVersion":"5.0.0","matchedVersion":"5.0.0","fixReleasedAt":"2024-10-09T13:04:16.634Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:24.817Z"}]}}