Detections
Analytics

SCA: security update for gradio (GHSA-gvv6-33j7-884g)

medium Tenable Self-Hosted Container Security Plugin ID 415325

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves
 **Cross-Site Scripting (XSS)** on any Gradio server that allows file uploads. Authenticated users can
 upload files such as HTML, JavaScript, or SVG files containing malicious scripts. When other users
 download or view these files, the scripts will execute in their browser, allowing attackers to perform
 unauthorized actions or steal sensitive information from their sessions. This impacts any Gradio server
 that allows file uploads, particularly those using components that process or display user-uploaded files.
 Users are advised to upgrade to `gradio>=5` to address this issue. As a workaround, users can restrict the
 types of files that can be uploaded to the Gradio server by limiting uploads to non-executable file types
 such as images or text. Additionally, developers can implement server-side validation to sanitize uploaded
 files, ensuring that HTML, JavaScript, and SVG files are properly handled or rejected before being stored
 or displayed to users. (CVE-2024-47872)

See Also

https://github.com/advisories/GHSA-gvv6-33j7-884g

Plugin Details

Severity: Medium

ID: 415325

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2024-47872

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 4.8

Threat Score: 1.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/10/2024

Vulnerability Publication Date: 10/10/2024

Reference Information

CVE: CVE-2024-47872

cwe: CWE-79