{"data":{"id":"6c0c6579-9342-4255-81c3-ab94cbe9fea0","title":"CVE-2024-0964: A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API…","summary":"CVE-2024-0964 is a local file include in Gradio that can be triggered remotely through a vulnerable user-supplied JSON value in an API request. It is classified as CWE-22, Improper Limitation of a Pathname to a Restricted Directory. NVD published it on 02/05/2024 and last modified it on 11/21/2024, with no NVD assessment yet provided.","solution":"The source links a patch at https://github.com/gradio-app/gradio/commit/d76bcaaaf0734aaf49a680f94ea9d4d22a602e70, but it does not describe the fix or name a fixed version.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-0964","publishedAt":"2024-02-06T04:15:08.190Z","cveId":"CVE-2024-0964","cweIds":["CWE-22","CWE-22"],"cvssScore":"9.4","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@< 4.9.0 (fixed: 4.9.0)"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Gradio local file include through user-supplied JSON value in API request","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00959,"epssCheckedAt":"2026-11-04T06:10:15.975Z","kevDateAdded":null,"advisoryAliases":["GHSA-f3h9-8phc-6gvh"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:30.783Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-12-13T02:37:44.735Z","daysToFix":-55,"fixCheckedAt":"2026-10-29T21:46:26.726Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"gradio","fixedVersion":"4.9.0","matchedVersion":"4.9.0","fixReleasedAt":"2023-12-13T02:37:44.735Z","daysToFix":-55,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:26.575Z"}]}}