CVE-2024-4941: Local file inclusion in Gradio JSON component

# CVE-2024-4941: Local file inclusion in Gradio JSON component

https://gcdradar.vercel.app/incidents/cve-2024-4941-local-file-inclusion-in-gradio-json-component · AIR-2024-0126 · closed 2024-06-06

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2024-06-06
- AI role: Attack on AI
- Products: gradio
- CVE ids: CVE-2024-4941
- CVSS: 7.5

## Summary

A local file inclusion flaw in Gradio permits unauthorized file retrieval via the JSON component endpoint. Vendor patches address the improper input validation issue.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2024-06-06: CVE-2024-4941: A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. (https://nvd.nist.gov/vuln/detail/CVE-2024-4941)
- 2024-06-06: CVE-2024-4941: Local file inclusion in gradio (https://github.com/advisories/GHSA-6v6g-j5fq-hpvw)

## Sources

- 2024-06-06 GitHub Advisory Database: CVE-2024-4941: Local file inclusion in gradio https://github.com/advisories/GHSA-6v6g-j5fq-hpvw
- 2024-06-06 NVD: CVE-2024-4941: A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. https://nvd.nist.gov/vuln/detail/CVE-2024-4941

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.