CVE-2024-4253

A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modification of the base repository or secrets exfiltration. The issue affects versions up to and including '@gradio/video@0.6.12'. The flaw is present in the workflow's handling of GitHub context information, where it echoes the full name of the head repository, the head branch, and the workflow reference without adequate sanitization. This could potentially lead to the exfiltration of sensitive secrets such as 'GITHUB_TOKEN', 'COMMENT_TOKEN', and 'CHROMATIC_PROJECT_TOKEN'.

• CWE-78

• https://github.com/gradio-app/gradio/commit/a0e70366a8a406fdd80abb21e8c88a3c8e682a2bPatch
• https://huntr.com/bounties/23cb3749-8ae9-4e1a-9023-4a20ca6b675eExploit, Third Party Advisory
• https://github.com/gradio-app/gradio/commit/a0e70366a8a406fdd80abb21e8c88a3c8e682a2bPatch
• https://huntr.com/bounties/23cb3749-8ae9-4e1a-9023-4a20ca6b675eExploit, Third Party Advisory

Published

Jun 4, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42514A vulnerability in the legacy chat component of Mitel MiCont…8.1
• CVE-2024-42515Glossarizer through 1.5.2 improperly tries to convert text i…9.9
• CVE-2024-42516HTTP response splitting in the core of Apache HTTP Server al…7.5
• CVE-2024-4252A vulnerability classified as critical has been found in Ten…8.8
• CVE-2024-42520TOTOLINK A3002R v4.0.0-B20230531.1404 contains a buffer over…9.8
• CVE-2024-42523publiccms V4.0.202302.e and before is vulnerable to Any File…7.2
• CVE-2024-42531Ezviz Internet PT Camera CS-CV246 D15655150 allows an unauth…9.8
• CVE-2024-42533SQL injection vulnerability in the authentication module in …9.8
• CVE-2024-4254The 'deploy-website.yml' workflow in the gradio-app/gradio r…7.1
• CVE-2024-42543TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow…9.8
• CVE-2024-42545TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow…9.8
• CVE-2024-42546TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflo…9.8