CVE-2024-10707: gaizhenbiao/chuanhuchatgpt local file inclusion through handle_dataset_selection

Summary

CVE-2024-10707 affects gaizhenbiao/chuanhuchatgpt at git d4ec6a3. The flaw is a local file inclusion caused by the gradio component gr.JSON, which has a known issue (CVE-2024-4941), and by improper input validation in the handle_dataset_selection function. Unauthenticated users can read arbitrary files on the server by uploading a specially crafted JSON file. The NVD has not yet provided an assessment.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• CriticalCVE-2026-108263: Astron Agent code-node execution as root through workflow run endpointsSimilar attack · NVD/CVE Database
• MediumHackers abuse Google Ads, Bing redirects to push Claude ClickFix attacksSimilar attack · BleepingComputer
• CriticalHermes Agent - PKCE Session Takeover via Redirect-URI Parser ConfusionSimilar attack · Tenable Research Advisories
• LowSocial Engineering AI Agents: The New BEC for 2026Similar attack · Dark Reading
• HighGHSA-cv3g-hj65-pcfh: PraisonAI: Shell command allowlist bypass via find -exec built-in actionSimilar attack · GitHub Advisory Database