Security: multiple gradio advisories appear reachable in pdfGPT

Security: multiple gradio advisories appear reachable in pdfGPT

Summary

During local dependency-impact validation, we observed behavior indicating that bhaskatripathi/pdfGPT reaches code paths involving vulnerable gradio versions. Please review whether the project currently pins or allows affected gradio releases, and upgrade or constrain the dependency if needed.

Affected dependency

• Repository: https://github.com/bhaskatripathi/pdfGPT
• Dependency: gradio
• Version(s) observed: 4.11.0

Advisories observed

• CVE-2024-1183 / GHSA-qh6x-j82h-vpf9: https://github.com/advisories/GHSA-qh6x-j82h-vpf9
• CVE-2024-4940 / GHSA-g6c9-f4xm-9j4x: https://github.com/advisories/GHSA-g6c9-f4xm-9j4x
• CVE-2024-8021 / GHSA-7v2w-h4gh-w5cv: https://github.com/advisories/GHSA-7v2w-h4gh-w5cv
• CVE-2024-1728 / GHSA-3f95-mxq2-2f63: https://github.com/advisories/GHSA-3f95-mxq2-2f63
• CVE-2024-1561 / GHSA-g9cj-cfpp-4g2x: https://github.com/advisories/GHSA-g9cj-cfpp-4g2x

Local validation notes

• CVE-2024-1183, gradio 4.11.0: Local proof returned a redirect through the application file endpoint.
• CVE-2024-4940, gradio 4.11.0: Local proof returned a redirect through the application file endpoint.
• CVE-2024-8021, gradio 4.11.0: Local proof returned a redirect through the application file endpoint.
• CVE-2024-1728, gradio 4.11.0: Local proof returned cached file content through the application file endpoint.
• CVE-2024-1561, gradio 4.11.0: Local proof returned cached file content through the application file endpoint.

Suggested fix

Please upgrade gradio to a version that includes the upstream security fixes for the advisories above, or add a dependency constraint that prevents affected versions from being installed.

Disclosure note

We have not opened a public security issue elsewhere for these rows. If you prefer a private disclosure route, please point us to the right channel.