{"data":{"id":"cb2a4c4e-510e-4f1e-87c0-1945ab4b4a72","title":"CVE-2022-24770: `gradio` is an open source framework for building interactive machine learning models and demos. Prior to version…","summary":"Prior to version 2.8.11, the `gradio` library's flagging feature saves input and output data into a CSV file on the developer's computer without neutralizing formula elements. A user can therefore store arbitrary text such as commands in that file, and when a spreadsheet program like MS Excel opens it, those commands run automatically on the developer's machine.","solution":"Fixed in 2.8.11, which escapes the saved CSV with single quotes. Workaround: avoid opening CSV files generated by `gradio` with Excel or similar spreadsheet programs.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-24770","publishedAt":"2022-03-17T21:15:08.133Z","cveId":"CVE-2022-24770","cweIds":["CWE-1236"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@< 2.8.11 (fixed: 2.8.11)"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"gradio CSV injection in flagged output files","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01298,"epssCheckedAt":"2026-11-04T18:09:13.251Z","kevDateAdded":null,"advisoryAliases":["GHSA-f8xq-q7px-wg8c"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:58:22.777Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2022-03-17T19:12:19.250Z","daysToFix":0,"fixCheckedAt":"2026-10-29T21:48:54.995Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"gradio","fixedVersion":"2.8.11","matchedVersion":"2.8.11","fixReleasedAt":"2022-03-17T19:12:19.250Z","daysToFix":0,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:48:54.845Z"}]}}