CVE-2024-0964: Gradio local file include through user-supplied JSON value in API request

Summary

CVE-2024-0964 is a local file include in Gradio that can be triggered remotely through a vulnerable user-supplied JSON value in an API request. It is classified as CWE-22, Improper Limitation of a Pathname to a Restricted Directory. NVD published it on 02/05/2024 and last modified it on 11/21/2024, with no NVD assessment yet provided.

Mitigation

The source links a patch at https://github.com/gradio-app/gradio/commit/d76bcaaaf0734aaf49a680f94ea9d4d22a602e70, but it does not describe the fix or name a fixed version.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• gradioPyPILLM dependency since 2023-03-14 · 11 tracked dependents

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online