Database/AI/ML frameworks & serving
Gradio (`/component_server`): Arbitrary method invocation on components
Impact
Arbitrary method invocation on components → local file read
Who can reach it
Unauthenticated network to any exposed Gradio demo
What to do
Upgrade to 4.19.2+. Tenant-launched Gradio demos on GPU nodes routinely get public share links — provider should block or gate share=True egress
Fleet impact
How widespread
Very common - Gradio is the default demo/eval UI shipped in AI containers and on Hugging Face Spaces; frequently exposed with share=True from a GPU node
Cost to remediate
**Image rebuild** (daemon-restart per app) - upgrade to Gradio 4.13.0+ in every image that bundles it, which in practice is most inference/demo images
Why it hits the whole fleet
/component_server invokes arbitrary Component methods, so move_resource_to_block_cache() reads any file on the host - API keys and cloud credentials in env/files - from an internet-exposed demo running on a GPU node
References
Related entries
- Gradio: Local file inclusion via improper input validationCVE-2024-1728 · GradioHigh
- ONNX: Directory traversal in `external_data` — bypass of the 1.13 fixCVE-2024-27318 · ONNXHigh
- joblib (`NumpyArrayWrapper.read_array`): Deserialization vulnerability in joblib 1.4.2CVE-2024-34997 · joblib (`NumpyArrayWrapper.read_array`)High
- Jupyter Server (Windows): Unauthenticated attackers can leak the NTLM hash of the hostCVE-2024-35178 · Jupyter Server (Windows)High
- Ollama: File-existence disclosure via `api/create`CVE-2024-39719 · OllamaHigh
- Ollama: Path traversal in `api/push` discloses server filesystem layoutCVE-2024-39722 · OllamaHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.