CVE-2022-24770

`gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which saves input/output data into a CSV file on the developer's computer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel opens such a file, then it automatically runs these commands, which could lead to arbitrary commands running on the user's computer. The problem has been patched as of `2.8.11`, which escapes the saved csv with single quotes. As a workaround, avoid opening csv files generated by `gradio` with Excel or similar spreadsheet programs.

• CWE-1236

• https://github.com/gradio-app/gradio/commit/80fea89117358ee105973453fdc402398ae20239Patch, Third Party Advisory
• https://github.com/gradio-app/gradio/pull/817Patch, Third Party Advisory
• https://github.com/gradio-app/gradio/security/advisories/GHSA-f8xq-q7px-wg8cThird Party Advisory
• https://github.com/gradio-app/gradio/commit/80fea89117358ee105973453fdc402398ae20239Patch, Third Party Advisory
• https://github.com/gradio-app/gradio/pull/817Patch, Third Party Advisory
• https://github.com/gradio-app/gradio/security/advisories/GHSA-f8xq-q7px-wg8cThird Party Advisory

Published

Mar 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24765Git for Windows is a fork of Git containing Windows-specific…7.8
• CVE-2022-24766mitmproxy is an interactive, SSL/TLS-capable intercepting pr…9.8
• CVE-2022-24767GitHub: Git for Windows' uninstaller vulnerable to DLL hijac…7.8
• CVE-2022-24768Argo CD is a declarative, GitOps continuous delivery tool fo…8.8
• CVE-2022-24769Moby is an open-source project created by Docker to enable a…5.9
• CVE-2022-2477Use after free in Guest View in Google Chrome prior to 103.0…8.8
• CVE-2022-24771Forge (also called `node-forge`) is a native implementation …7.5
• CVE-2022-24772Forge (also called `node-forge`) is a native implementation …7.5
• CVE-2022-24773Forge (also called `node-forge`) is a native implementation …5.3
• CVE-2022-24774CycloneDX BOM Repository Server is a bill of materials (BOM)…8.1
• CVE-2022-24775guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions pr…7.5
• CVE-2022-24776Flask-AppBuilder is an application development framework, bu…6.1