{"id":"PYSEC-2023-255","details":"Command Injection in GitHub repository gradio-app/gradio prior to main.","aliases":["CVE-2023-6572","GHSA-gqvf-3hgp-5hxv"],"modified":"2026-06-10T17:01:08.470572128Z","published":"2023-12-14T14:15:00Z","references":[{"type":"EVIDENCE","url":"https://huntr.com/bounties/21d2ff0c-d43a-4afd-bb4d-049ee8da5b5c"},{"type":"REPORT","url":"https://huntr.com/bounties/21d2ff0c-d43a-4afd-bb4d-049ee8da5b5c"},{"type":"FIX","url":"https://huntr.com/bounties/21d2ff0c-d43a-4afd-bb4d-049ee8da5b5c"},{"type":"WEB","url":"https://huntr.com/bounties/21d2ff0c-d43a-4afd-bb4d-049ee8da5b5c"},{"type":"FIX","url":"https://github.com/gradio-app/gradio/commit/5b5af1899dd98d63e1f9b48a93601c2db1f56520"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gqvf-3hgp-5hxv"}],"affected":[{"package":{"name":"gradio","ecosystem":"PyPI","purl":"pkg:pypi/gradio"},"ranges":[{"type":"GIT","repo":"https://github.com/gradio-app/gradio","events":[{"introduced":"0"},{"fixed":"5b5af1899dd98d63e1f9b48a93601c2db1f56520"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.1","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.4.0","0.4.1","0.4.2","0.4.4","0.5.0","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.8.0","0.8.1","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9.2","0.9.9.3","0.9.9.5","0.9.9.6","0.9.9.7","0.9.9.8","0.9.9.9","0.9.9.9.2","1.0.0","1.0.0a1","1.0.0a3","1.0.0a4","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.8","1.1.8.1","1.1.9","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.4.0","1.4.2","1.4.3","1.4.4","1.5.0","1.5.1","1.5.3","1.5.4","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","2.0.0","2.0.1","2.0.10","2.0.2","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.1","2.1.2","2.1.4","2.1.6","2.1.7","2.2.0","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9a0","2.2.9a2","2.3.0","2.3.0a0","2.3.0b101","2.3.0b102","2.3.0b99","2.3.3","2.3.4","2.3.5","2.3.5b0","2.3.6","2.3.7","2.3.7b0","2.3.7b1","2.3.7b2","2.3.8b0","2.3.9","2.4.0","2.4.0a0","2.4.1","2.4.2","2.4.4","2.4.5","2.4.6","2.4.7b0","2.4.7b2","2.4.7b3","2.4.7b4","2.4.7b5","2.4.7b6","2.4.7b7","2.4.7b8","2.4.7b9","2.5.0","2.5.1","2.5.2","2.5.3","2.5.8a0","2.6.0","2.6.1","2.6.1a0","2.6.1b0","2.6.1b3","2.6.2","2.6.3","2.6.4","2.6.4b0","2.6.4b2","2.6.4b3","2.7.0","2.7.0a101","2.7.0a102","2.7.0b70","2.7.5","2.7.5.1","2.7.5.2","2.7.5.2b0","2.8.0","2.8.0a100","2.8.0b0","2.8.0b10","2.8.0b12","2.8.0b2","2.8.0b20","2.8.0b22","2.8.0b3","2.8.0b4","2.8.0b5","2.8.0b6","2.8.1","2.8.10","2.8.11","2.8.12","2.8.13","2.8.14","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.0.1","2.9.0b0","2.9.0b1","2.9.0b10","2.9.0b2","2.9.0b3","2.9.0b5","2.9.0b6","2.9.0b7","2.9.0b8","2.9.0b9","2.9.1","2.9.2","2.9.3","2.9.4","2.9b11","2.9b12","2.9b13","2.9b14","2.9b15","2.9b20","2.9b21","2.9b22","2.9b23","2.9b24","2.9b25","2.9b26","2.9b27","2.9b28","2.9b30","2.9b31","2.9b32","2.9b33","2.9b40","2.9b48","2.9b50","3.0","3.0.1","3.0.10","3.0.10b16","3.0.10b2","3.0.11","3.0.11b1","3.0.12","3.0.13","3.0.13b100","3.0.13b13","3.0.13b15","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.18b0","3.0.19","3.0.19b0","3.0.19b1","3.0.19b2","3.0.1b120","3.0.1b121","3.0.1b300","3.0.2","3.0.20","3.0.20.dev0","3.0.21","3.0.22","3.0.23","3.0.23.dev1","3.0.24","3.0.25","3.0.26","3.0.3","3.0.4","3.0.5","3.0.6","3.0.6b1","3.0.6b2","3.0.6b3","3.0.7","3.0.8","3.0.8b1","3.0.9","3.0.9b10","3.0.9b11","3.0.9b20","3.0b0","3.0b1","3.0b10","3.0b2","3.0b5","3.0b6","3.0b8","3.0b9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.3a0","3.1.3a2","3.1.3a3","3.1.3a4","3.1.3a5","3.1.4","3.1.4b0","3.1.4b1","3.1.4b2","3.1.4b3","3.1.4b4","3.1.4b5","3.1.5","3.1.5b1","3.1.5b10","3.1.5b2","3.1.5b3","3.1.5b4","3.1.5b5","3.1.5b7","3.1.5b8","3.1.5b9","3.1.6","3.1.6b1","3.1.7","3.1.8b0","3.1.8b2","3.1.8b3","3.1.8b4","3.1.8b6","3.10.0","3.10.1","3.11.0","3.12.0","3.12.0b1","3.12.0b2","3.12.0b3","3.12.0b6","3.12.0b7","3.13.0","3.13.0b1","3.13.1","3.13.1b0","3.13.1b1","3.13.1b2","3.13.2","3.14.0","3.14.0a1","3.15.0","3.16.0","3.16.1","3.16.1b1","3.16.2","3.17.0","3.17.1","3.17.1b1","3.17.1b2","3.18.0","3.18.1b1","3.18.1b2","3.18.1b3","3.18.1b4","3.18.1b5","3.18.1b6","3.18.1b7","3.19.0","3.19.1","3.2","3.2.1b0","3.2.1b1","3.2.1b2","3.20.0","3.20.0b1","3.20.0b2","3.20.1","3.21.0","3.22.0","3.22.1","3.22.1b1","3.23.0","3.23.1b1","3.23.1b2","3.23.1b3","3.24.0","3.24.1","3.25.0","3.25.1b1","3.25.1b2","3.26.0","3.27.0","3.28.0","3.28.1","3.28.2","3.28.3","3.28.4b0","3.29.0","3.3","3.3.1","3.30.0","3.31.0","3.32.0","3.33.0","3.33.1","3.34.0","3.35.0","3.35.1","3.35.2","3.36.0","3.36.1","3.37.0","3.38.0","3.39.0","3.3b0","3.3b1","3.4","3.4.1","3.40.0","3.40.1","3.41.0","3.41.1","3.41.2","3.42.0","3.43.0","3.43.1","3.43.2","3.44.0","3.44.1","3.44.2","3.44.3","3.44.4","3.45.0","3.45.0b0","3.45.0b1","3.45.0b10","3.45.0b11","3.45.0b12","3.45.0b13","3.45.0b2","3.45.0b3","3.45.0b4","3.45.0b5","3.45.0b6","3.45.0b7","3.45.0b8","3.45.0b9","3.45.1","3.45.2","3.46.0","3.46.1","3.47.0","3.47.1","3.48.0","3.49.0","3.4b0","3.4b1","3.4b2","3.4b3","3.4b5","3.5","3.50.0","3.50.1","3.50.2","3.6","3.6.0b1","3.6.0b10","3.6.0b2","3.6.0b3","3.6.0b7","3.7","3.8","3.8.1","3.8.1.dev1","3.8.2","3.8b1","3.8b2","3.9","3.9.1","4.0.0","4.0.0b15","4.0.1","4.0.2","4.1.0","4.1.1","4.1.2","4.10.0","4.11.0","4.12.0","4.13.0","4.2.0","4.3.0","4.4.0","4.4.1","4.5.0","4.7.0","4.7.1","4.8.0","4.9.0","4.9.1","gradio@3.50.2","gradio@4.1.1","@gradio/gallery@0.4.3","@gradio/dataframe@0.3.3","gradio@4.1.0","@gradio/video@0.1.2","@gradio/uploadbutton@0.1.2","@gradio/upload@0.3.2","@gradio/tootils@0.1.1","@gradio/radio@0.3.1","@gradio/preview@0.2.0","@gradio/model3d@0.4.0","@gradio/image@0.3.2","@gradio/gallery@0.4.2","@gradio/file@0.2.2","@gradio/dataset@0.1.2","@gradio/dataframe@0.3.2","@gradio/code@0.2.2","@gradio/checkboxgroup@0.3.1","@gradio/chatbot@0.4.2","@gradio/button@0.2.2","@gradio/audio@0.4.2","gradio@4.0.2","@gradio/preview@0.1.1","gradio@4.0.1","@gradio/video@0.1.1","@gradio/uploadbutton@0.1.1","@gradio/upload@0.3.1","@gradio/model3d@0.3.1","@gradio/image@0.3.1","@gradio/gallery@0.4.1","@gradio/file@0.2.1","@gradio/dataset@0.1.1","@gradio/dataframe@0.3.1","@gradio/code@0.2.1","@gradio/client@0.7.1","@gradio/chatbot@0.4.1","@gradio/button@0.2.1","@gradio/audio@0.4.1","gradio_client@0.7.0","gradio@4.0.0","@gradio/wasm@0.2.0","@gradio/video@0.1.0","@gradio/utils@0.2.0","@gradio/uploadbutton@0.1.0","@gradio/upload@0.3.0","@gradio/tootils@0.1.0","@gradio/tooltip@0.1.0","@gradio/theme@0.2.0","@gradio/textbox@0.4.0","@gradio/tabs@0.1.0","@gradio/tabitem@0.1.0","@gradio/statustracker@0.3.0","@gradio/state@0.1.0","@gradio/slider@0.2.0","@gradio/simpletextbox@0.1.0","@gradio/simpledropdown@0.1.0","@gradio/row@0.1.0","@gradio/radio@0.3.0","@gradio/preview@0.1.0","@gradio/plot@0.2.0","@gradio/number@0.3.0","@gradio/model3d@0.3.0","@gradio/markdown@0.3.0","@gradio/label@0.2.0","@gradio/json@0.1.0","@gradio/image@0.3.0","@gradio/icons@0.2.0","@gradio/html@0.1.0","@gradio/highlightedtext@0.4.0","@gradio/group@0.1.0","@gradio/gallery@0.4.0","@gradio/form@0.1.0","@gradio/file@0.2.0","@gradio/fallback@0.2.0","@gradio/dropdown@0.3.0","@gradio/dataset@0.1.0","@gradio/dataframe@0.3.0","@gradio/column@0.1.0","@gradio/colorpicker@0.2.0","@gradio/code@0.2.0","@gradio/client@0.7.0","@gradio/checkboxgroup@0.3.0","@gradio/checkbox@0.2.0","@gradio/chatbot@0.4.0","@gradio/button@0.2.0","@gradio/box@0.1.0","@gradio/audio@0.4.0","@gradio/atoms@0.2.0","gradio_client@0.7.0-beta.2","gradio@4.0.0-beta.15","@gradio/wasm@0.2.0-beta.2","@gradio/video@0.1.0-beta.9","@gradio/utils@0.2.0-beta.6","@gradio/uploadbutton@0.1.0-beta.7","@gradio/upload@0.3.0-beta.6","@gradio/tootils@0.1.0-beta.7","@gradio/tooltip@0.1.0-beta.2","@gradio/theme@0.2.0-beta.2","@gradio/textbox@0.4.0-beta.8","@gradio/tabs@0.1.0-beta.8","@gradio/tabitem@0.1.0-beta.8","@gradio/statustracker@0.3.0-beta.8","@gradio/state@0.1.0-beta.2","@gradio/slider@0.2.0-beta.8","@gradio/simpletextbox@0.1.0-beta.2","@gradio/simpledropdown@0.1.0-beta.3","@gradio/row@0.1.0-beta.2","@gradio/radio@0.3.0-beta.8","@gradio/preview@0.1.0-beta.8","@gradio/plot@0.2.0-beta.8","@gradio/number@0.3.0-beta.8","@gradio/model3d@0.3.0-beta.8","@gradio/markdown@0.3.0-beta.8","@gradio/label@0.2.0-beta.8","@gradio/json@0.1.0-beta.8","@gradio/image@0.3.0-beta.9","@gradio/icons@0.2.0-beta.3","@gradio/html@0.1.0-beta.8","@gradio/highlightedtext@0.4.0-beta.8","@gradio/group@0.1.0-beta.2","@gradio/gallery@0.4.0-beta.9","@gradio/form@0.1.0-beta.7","@gradio/file@0.2.0-beta.8","@gradio/fallback@0.2.0-beta.8","@gradio/dropdown@0.3.0-beta.8","@gradio/dataset@0.1.0-beta.2","@gradio/dataframe@0.3.0-beta.8","@gradio/column@0.1.0-beta.3","@gradio/colorpicker@0.2.0-beta.8","@gradio/code@0.2.0-beta.8","@gradio/client@0.7.0-beta.1","@gradio/checkboxgroup@0.3.0-beta.8","@gradio/checkbox@0.2.0-beta.8","@gradio/chatbot@0.4.0-beta.9","@gradio/button@0.2.0-beta.7","@gradio/box@0.1.0-beta.7","@gradio/audio@0.4.0-beta.9","@gradio/atoms@0.2.0-beta.6","@gradio/lite@0.4.3","gradio@3.50.1","@gradio/lite@0.4.2","gradio@3.50.0","@gradio/lite@0.4.1","@gradio/lite@0.4.0","gradio@3.49.0","@gradio/client@0.6.0","gradio_client@0.6.1","gradio@3.48.0","@gradio/lite@0.3.2","@gradio/client@0.5.2","gradio@3.47.1","@gradio/client@0.5.1","gradio_client@0.6.0","gradio@3.47.0","@gradio/client@0.5.0","gradio@3.46.1","@gradio/client@0.4.2","gradio@3.46.0","gradio_client@0.5.3","gradio@3.45.2","@gradio/client@0.4.1","gradio@3.45.1","gradio_client@0.5.2","gradio@3.45.0","@gradio/client@0.4.0","gradio_client@0.5.1","gradio@3.44.4","gradio@3.44.3","gradio@3.44.2","gradio@3.44.1","gradio@3.44.0","gradio@3.43.2","gradio@3.43.1","gradio@3.43.0","@gradio/client@0.3.1","gradio@3.42.0","@gradio/client@0.3.0","gradio@3.41.2","gradio@3.41.1","v3.41.0","gradio_client@0.5.0","gradio@3.41.0","@gradio/lite@0.3.1","@gradio/client@0.2.1","v3.40.1","v3.40.0","v3.39.0","v3.38.0","v3.37.0","v3.36.1","v3.36.0","v3.35.2","v3.35.1","v3.35.0","v3.34.0","v3.33.1","v3.33.0","v3.32.0","v3.31.0","v3.30.0","v3.29.0","v3.28.4b0","v3.28.3","v3.28.2","v3.28.1","v3.28.0","v3.27.0","v3.26.0","v3.25.1b2","v3.25.1b1","v3.25.0","v3.24.1","v3.24.0","v3.23.1b3","v3.23.1b2","v3.23.1b1","v3.23.0","v3.22.1b1","v3.22.1","v3.22.0","v3.21.0","v3.20.1","v3.20.0","v3.20.0b2","v3.19.1","v3.19.0","v3.18.1b7","v3.18.1b6","v3.18.1b5","v3.18.1b4","v3.18.1b3","v3.18.1b2","v3.18.1b1","v3.18.0","v3.17.1b2","v3.17.1b1","v3.17.1","v3.17.0","v3.16.2","v3.16.1b1","v3.16.1","v3.0.1b300","v3.16.0","v3.15.0","v3.14.0a1","v3.14.0","v3.12.0b7","v3.13.2","v3.13.1b2","v3.13.1b1","v3.13.1b0","v3.13.1","v3.13.0b1","v3.13.0","v3.12.0b6","v3.12.0b3","v3.12.0b2","v3.12.0b1","v3.12.0","v3.11.0","v3.10.1","v3.10.0","v3.9.1","v3.9","v3.8.2","v3.8.1dev1","v3.8.1","v3.8b2","v3.8b1","v3.8","v3.6.0b7","v3.7","v3.6.0b10","v3.6.0b3","v3.6.0b2","v3.6.0b1","v3.6","v3.0.1b150","v3.5","v3.0.1b123","v3.0.1b121","v3.0.1b120","v3.4.1","v3.4b5","v3.4b2","v3.4","v3.4b3","v3.4b1","v3.4b0","v3.3.1","v3.3b1","v3.3.b0","v3.3","v3.2.1b2","v3.2.1b1","v3.2.1b0","v3.2","v3.1.8b","v3.1.7","v3.1.6","v3.1.5","v3.1.4b3","v3.1.4b2","v3.1.4b1","v3.1.4","v3.1.4b","v3.1.3","v3.1.3a3","v3.1.3a2","v3.1.3a","v3.1.1","v3.1.0","v3.0.26","v3.0.25","v3.0","v2.9.0","v2.8.1","v2.7.5","v2.7.1","v2.6.0","v2.4.0","v2.3.6"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/gradio/PYSEC-2023-255.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}