Description
A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process input values, which can accept compressed files. An attacker can exploit this by uploading a maliciously crafted zip bomb, leading to a server crash and causing a denial of service.
Published: 2025-03-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-7112 A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process input values, which can accept compressed files. An attacker can exploit this by uploading a maliciously crafted zip bomb, leading to a server crash and causing a denial of service.
Github GHSA Github GHSA GHSA-7xmc-vhjp-qv5q Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb
History

Tue, 07 Oct 2025 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Gradio Project
Gradio Project gradio
CPEs cpe:2.3:a:gradio_project:gradio:2024-09-18:*:*:*:*:python:*:*
Vendors & Products Gradio Project
Gradio Project gradio

Fri, 21 Mar 2025 08:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Mar 2025 10:15:00 +0000

Type Values Removed Values Added
Description A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process input values, which can accept compressed files. An attacker can exploit this by uploading a maliciously crafted zip bomb, leading to a server crash and causing a denial of service.
Title Zip Bomb Vulnerability in gradio-app/gradio
Weaknesses CWE-475
References
Metrics cvssV3_0

{'score': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Gradio Project Gradio
cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published:

Updated: 2025-03-20T17:53:15.263Z

Reserved: 2024-10-30T21:45:44.013Z

Link: CVE-2024-10569

cve-icon Vulnrichment

Updated: 2025-03-20T17:53:04.868Z

cve-icon NVD

Status : Analyzed

Published: 2025-03-20T10:15:17.640

Modified: 2025-10-07T20:58:52.973

Link: CVE-2024-10569

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses