GradioGHSA-f8xq-q7px-wg8c
Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging
High8.8CVE-2022-24770 · Published Mar 18, 2022 · updated Nov 8, 2023
### Impact The `gradio` library has a flagging functionality which saves input/output data into a CSV file on the developer's computer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel opens such a file, then it automatically runs these commands, which could lead to arbitrary commands running on the user's computer. ### Patches The problem has been patched as of `2.8.11`, which escapes the data saved to the csv with single quotes. ### Workarounds If you are using an older version of `gradio`, don't open csv files generated by `gradio` with Excel or similar spreadsheet programs.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| gradio PyPI | < 2.8.11 | 2.8.11 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-1236
- Also known as
- CVE-2022-24770, PYSEC-2022-229
- github.com/gradio-app/gradio/security/advisories/GHSA-f8xq-q7px-wg8c
- nvd.nist.gov/vuln/detail/CVE-2022-24770
- github.com/gradio-app/gradio/pull/817
- github.com/gradio-app/gradio/commit/80fea89117358ee105973453fdc402398ae20239
- github.com/gradio-app/gradio
- github.com/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2022-229.yaml
More Gradio advisories
All Gradio| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Dec 212023 | Gradio makes the `/file` secure against file traversal and server-side request forgery attacks High8.6Dec 21, 2023 | High8.6 | 4.11.0 |
| Dec 142023 | Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerabilityCritical9.6Dec 14, 2023 | Critical9.6 | 4.14.0 |
| Sep 162023 | Gradio arbitrary file upload vulnerabilityMedium4.8Sep 16, 2023 | Medium4.8 | No fix yet |
| Jun 92023 | Gradio vulnerable to arbitrary file read and proxying of arbitrary URLsMedium7.3Jun 9, 2023 | Medium7.3 | 3.34.0 |
| Feb 232023 | Update share links to use FRP instead of SSH tunnelingMedium5.4Feb 23, 2023 | Medium5.4 | 3.13.1 |
| Jan 212022 | Files on the host computer can be accessed from the Gradio interfaceCritical8.3Jan 21, 2022 | Critical8.3 | 2.5.0 |