CVE-2024-47870

Date: October 10, 2024

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a race condition in the "update_root_in_config" function, allowing an attacker to modify the "root" URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition. Users are advised to upgrade to "gradio>=5" to address this issue. There are no known workarounds for this issue.

Language: Python