Advisoriesby IbisGradioGHSA-f8xq-q7px-wg8c
Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging
Fix: upgrade to 2.8.11 or later
Impact
The gradio library has a flagging functionality which saves input/output data into a CSV file on the developer's computer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel opens such a file, then it automatically runs these commands, which could lead to arbitrary commands running on the user's computer.
Patches
The problem has been patched as of 2.8.11, which escapes the data saved to the csv with single quotes.
Workarounds
If you are using an older version of gradio, don't open csv files generated by gradio with Excel or similar spreadsheet programs.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| gradio PyPI | < 2.8.11 | 2.8.11 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-1236
- Also known as
- CVE-2022-24770, PYSEC-2022-229
- github.com/gradio-app/gradio/security/advisories/GHSA-f8xq-q7px-wg8c
- nvd.nist.gov/vuln/detail/CVE-2022-24770
- github.com/gradio-app/gradio/pull/817
- github.com/gradio-app/gradio/commit/80fea89117358ee105973453fdc402398ae20239
- github.com/gradio-app/gradio
- github.com/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2022-229.yaml
More Gradio advisories
All Gradio
Gradio makes the `/file` secure against file traversal and server-side request forgery attacksCVE-2023-51449fixed in 4.11.0Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerabilityCVE-2023-6572fixed in 4.14.0Gradio arbitrary file upload vulnerabilityCVE-2023-41626no fix yetGradio vulnerable to arbitrary file read and proxying of arbitrary URLsCVE-2023-34239fixed in 3.34.0Update share links to use FRP instead of SSH tunnelingCVE-2023-25823fixed in 3.13.1Files on the host computer can be accessed from the Gradio interfaceCVE-2021-43831fixed in 2.5.0