CVE-2024-4254

The 'deploy-website.yml' workflow in the gradio-app/gradio repository, specifically in the 'main' branch, is vulnerable to secrets exfiltration due to improper authorization. The vulnerability arises from the workflow's explicit checkout and execution of code from a fork, which is unsafe as it allows the running of untrusted code in an environment with access to push to the base repository and access secrets. This flaw could lead to the exfiltration of sensitive secrets such as GITHUB_TOKEN, HF_TOKEN, VERCEL_ORG_ID, VERCEL_PROJECT_ID, COMMENT_TOKEN, AWSACCESSKEYID, AWSSECRETKEY, and VERCEL_TOKEN. The vulnerability is present in the workflow file located at https://github.com/gradio-app/gradio/blob/72f4ca88ab569aae47941b3fb0609e57f2e13a27/.github/workflows/deploy-website.yml.

• CWE-214

• https://huntr.com/bounties/59873fbd-5698-4ec3-87f9-5d70c6055d01Exploit, Third Party Advisory
• https://huntr.com/bounties/59873fbd-5698-4ec3-87f9-5d70c6055d01Exploit, Third Party Advisory

Published

Jun 4, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4252A vulnerability classified as critical has been found in Ten…8.8
• CVE-2024-42520TOTOLINK A3002R v4.0.0-B20230531.1404 contains a buffer over…9.8
• CVE-2024-42523publiccms V4.0.202302.e and before is vulnerable to Any File…7.2
• CVE-2024-4253A command injection vulnerability exists in the gradio-app/g…9.1
• CVE-2024-42531Ezviz Internet PT Camera CS-CV246 D15655150 allows an unauth…9.8
• CVE-2024-42533SQL injection vulnerability in the authentication module in …9.8
• CVE-2024-42543TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow…9.8
• CVE-2024-42545TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow…9.8
• CVE-2024-42546TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflo…9.8
• CVE-2024-42547TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflo…9.8
• CVE-2024-4255A vulnerability, which was classified as critical, has been …7.2
• CVE-2024-42550A cross-site scripting (XSS) vulnerability in the component …5.4