Vulnerability in Gradio-app Gradio

CVE-2024-47869

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since the comparison is not done in constant…

EPSS: 0.002 (36.4th percentile) — read the EPSS interpretation.

Affected products

Gradio-app Gradio — versions < 4.44

Weakness classification (CWE)

CWE-203 — Observable Discrepancy

References

https://github.com/gradio-app/gradio/security/advisories/GHSA-j757-pf57-f8r4 (x_refsource_CONFIRM)