{"data":{"id":"f353b05c-13f0-4aa9-ac32-7efce6a698bf","title":"CVE-2024-47867: Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a **lack of integrity…","summary":"Gradio, an open-source Python package for quick prototyping, does not verify the integrity of the FRP client it downloads for its sharing mechanism. The Gradio server does not check the file's checksum or signature, so an attacker who gains access to the remote URL can modify the binary without detection and introduce malicious code. Users of the sharing mechanism that relies on the FRP client are affected.","solution":"There is no direct workaround for this issue without upgrading. Users can manually validate the integrity of the downloaded FRP client by implementing checksum or signature verification in their own environment.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-47867","publishedAt":"2024-10-11T03:15:02.640Z","cveId":"CVE-2024-47867","cweIds":["CWE-345"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["gradio@< 5.0.0 (fixed: 5.0.0)"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Gradio lack of integrity check on downloaded FRP client","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00213,"epssCheckedAt":"2026-11-04T00:12:27.579Z","kevDateAdded":null,"advisoryAliases":["GHSA-8c87-gvhj-xm8m"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:03.403Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-10-09T13:04:16.634Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:45:23.425Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"gradio","fixedVersion":"5.0.0","matchedVersion":"5.0.0","fixReleasedAt":"2024-10-09T13:04:16.634Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:23.266Z"}]}}