{"data":{"id":"a0354f9f-cced-43ca-b0b2-27516f6cedb8","title":"CVE-2024-47869: Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack**…","summary":"CVE-2024-47869 affects Gradio, an open-source Python package for quick prototyping. Gradio compares hashes in the analytics_dashboard function without constant-time comparison, so an attacker can measure response times to infer the correct hash byte by byte. Repeated queries with different keys could lead to unauthorized access to the analytics dashboard.","solution":"Upgrade to gradio>4.44. Before applying the patch, developers can manually patch the analytics_dashboard dashboard to use a constant-time comparison function for sensitive values such as hashes, or disable access to the analytics dashboard.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-47869","publishedAt":"2024-10-11T03:15:02.930Z","cveId":"CVE-2024-47869","cweIds":["CWE-203"],"cvssScore":"3.7","cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@< 4.44.0 (fixed: 4.44.0)"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Gradio timing attack in hash comparison for analytics_dashboard","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00295,"epssCheckedAt":"2026-11-04T12:08:34.749Z","kevDateAdded":null,"advisoryAliases":["GHSA-j757-pf57-f8r4"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:02.357Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-09-10T21:46:23.568Z","daysToFix":-31,"fixCheckedAt":"2026-10-29T21:45:21.878Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"gradio","fixedVersion":"4.44.0","matchedVersion":"4.44.0","fixReleasedAt":"2024-09-10T21:46:23.568Z","daysToFix":-31,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:21.728Z"}]}}