{"data":{"id":"9a26fbe3-1e75-4068-8509-cb05fdfdf371","title":"CVE-2024-10569: A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The…","summary":"CVE-2024-10569 affects the dataframe component of gradio-app/gradio (version git 98cbcae). The component passes input values to pd.read_csv, which accepts compressed files, so an attacker can upload a maliciously crafted zip bomb. Exploitation crashes the server, causing a denial of service.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-10569","publishedAt":"2025-03-20T14:15:17.640Z","cveId":"CVE-2024-10569","cweIds":["CWE-475"],"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["gradio@>= 4.0.0, <= 5.0.0b2"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"gradio dataframe component zip bomb denial of service via upload","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00661,"epssCheckedAt":"2026-11-04T12:08:34.493Z","kevDateAdded":null,"advisoryAliases":["GHSA-7xmc-vhjp-qv5q"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:24.092Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}