{"data":{"id":"72bbcfe1-7061-46c1-a18c-80b20549f51e","title":"CVE-2021-43831: Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to…","summary":"Gradio versions prior to 2.5.0 do not restrict file paths, so anyone who receives a publicly shared Gradio link can read any file on the host if they know its name or path. Access is limited only by the host operating system, and paths are opened in read-only mode.","solution":"Fixed in gradio 2.5.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-43831","publishedAt":"2021-12-16T01:15:08.620Z","cveId":"CVE-2021-43831","cweIds":["CWE-22","CWE-22"],"cvssScore":"7.7","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@< 2.5.0 (fixed: 2.5.0)"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Gradio arbitrary file read through publicly shared interface links","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.03855,"epssCheckedAt":"2026-11-04T12:08:33.171Z","kevDateAdded":null,"advisoryAliases":["GHSA-rhq2-3vr9-6mcr"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:58:56.048Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2021-12-14T18:57:12.374Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:49:43.498Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"gradio","fixedVersion":"2.5.0","matchedVersion":"2.5.0","fixReleasedAt":"2021-12-14T18:57:12.374Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:49:43.327Z"}]}}