CVE-2024-1540

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1540
A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special elements used in a command. This vulnerability allows attackers to execute unauthorized commands, potentially leading to unauthorized modification of the base repository or secrets exfiltration. The issue arises from the unsafe handling of GitHub context information within a `run` operation, where expressions inside `${{ }}` are evaluated and substituted before script execution. Remediation involves setting untrusted input values to intermediate environment variables to prevent direct influence on script generation.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/gradio-app/gradio/commit/d56bb28df80d8db1f33e4acf4f6b2c4f87cb8b28 Patch
https://huntr.com/bounties/0e39e974-9a66-476f-91f5-3f37abb03d77 Exploit Third Party Advisory
https://github.com/gradio-app/gradio/commit/d56bb28df80d8db1f33e4acf4f6b2c4f87cb8b28 Patch
https://huntr.com/bounties/0e39e974-9a66-476f-91f5-3f37abb03d77 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*
History

30 Jul 2025, 19:57

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.6 		v2 : unknown
v3 : 8.2
References () https://github.com/gradio-app/gradio/commit/d56bb28df80d8db1f33e4acf4f6b2c4f87cb8b28 - () https://github.com/gradio-app/gradio/commit/d56bb28df80d8db1f33e4acf4f6b2c4f87cb8b28 - Patch
References () https://huntr.com/bounties/0e39e974-9a66-476f-91f5-3f37abb03d77 - () https://huntr.com/bounties/0e39e974-9a66-476f-91f5-3f37abb03d77 - Exploit, Third Party Advisory
CPE cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*
First Time Gradio Project gradio
Gradio Project

21 Nov 2024, 08:50

Type Values Removed Values Added
References () https://github.com/gradio-app/gradio/commit/d56bb28df80d8db1f33e4acf4f6b2c4f87cb8b28 - () https://github.com/gradio-app/gradio/commit/d56bb28df80d8db1f33e4acf4f6b2c4f87cb8b28 -
References () https://huntr.com/bounties/0e39e974-9a66-476f-91f5-3f37abb03d77 - () https://huntr.com/bounties/0e39e974-9a66-476f-91f5-3f37abb03d77 -

16 Apr 2024, 12:15

Type Values Removed Values Added
Summary
  • (es) Anteriormente, era posible filtrar secretos en el CI de Gradio, pero esto ya está solucionado.
Summary (en) Previously, it was possible to exfiltrate secrets in Gradio's CI, but this is now fixed. (en) A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special elements used in a command. This vulnerability allows attackers to execute unauthorized commands, potentially leading to unauthorized modification of the base repository or secrets exfiltration. The issue arises from the unsafe handling of GitHub context information within a `run` operation, where expressions inside `${{ }}` are evaluated and substituted before script execution. Remediation involves setting untrusted input values to intermediate environment variables to prevent direct influence on script generation.

27 Mar 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-27 16:15

Updated : 2025-07-30 19:57

NVD link : CVE-2024-1540

Mitre link : CVE-2024-1540

CVE.ORG link : CVE-2024-1540

JSON object : View

Products Affected

gradio_project

  • gradio
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')