CVE-2024-47872

Summary

CVE-2024-47872 is a Cross-Site Scripting (XSS) vulnerability affecting the open-source Python package Gradio. This issue allows authenticated users to upload malicious scripts in HTML, JavaScript, or SVG files to any Gradio server with file upload capabilities. When other users download or view these files, the scripts will execute in their browser, potentially granting attackers unauthorized access or the ability to steal sensitive information. This vulnerability primarily impacts Gradio servers that process or display user-uploaded files. To mitigate this risk, users are encouraged to upgrade to Gradio version 5 or higher. As a temporary solution, restricting the types of files that can be uploaded or implementing server-side validation to sanitize uploaded files can help prevent the execution of malicious scripts.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.