CVE-2024-47871: Gradio uses insecure communication between the FRP client and server
(updated )
What kind of vulnerability is it? Who is impacted?
This vulnerability involves insecure communication between the FRP (Fast Reverse Proxy) client and server when Gradio’s share=True
option is used. HTTPS is not enforced on the connection, allowing attackers to intercept and read files uploaded to the Gradio server, as well as modify responses or data sent between the client and server. This impacts users who are sharing Gradio demos publicly over the internet using share=True
without proper encryption, exposing sensitive data to potential eavesdroppers.
References
Detect and mitigate CVE-2024-47871 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →