{"id":"CVE-2023-6572","published":"2023-12-14T13:14:16Z","modified":"2025-05-22T17:43:11Z","title":"Command Injection in gradio-app/gradio","vendor":"gradio-app","product":"gradio-app/gradio","tier":"tail","description":{"text":"Command Injection in GitHub repository gradio-app/gradio prior to main.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01676,"percentile":0.76786,"provenance":"source"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"https://huntr.com/bounties/21d2ff0c-d43a-4afd-bb4d-049ee8da5b5c","tags":[]},{"url":"https://github.com/gradio-app/gradio/commit/5b5af1899dd98d63e1f9b48a93601c2db1f56520","tags":[]}],"priority":{"score":27.1,"factors":[{"name":"EPSS percentile","points":15.36},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.72}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-08-31","earliestUrl":"https://github.com/pvharmo2/gha-lab-6255f5fc33","repos":[{"name":"pvharmo2/gha-lab-6255f5fc33","url":"https://github.com/pvharmo2/gha-lab-6255f5fc33","stars":0,"created":"2026-08-31"}]},"first":{"date":"2026-08-31","source":"PoC-in-GitHub","url":"https://github.com/pvharmo2/gha-lab-6255f5fc33"},"provenance":"source"},"vendorSlug":"gradio-app","affectedVersions":[{"vendor":"gradio-app","product":"gradio-app/gradio","versions":[">= unspecified, < main"]}],"affected":[{"ecosystem":"PyPI","package":"gradio","vulnerableRanges":["<4.14.0"],"patched":["4.14.0"],"from":["GHSA-gqvf-3hgp-5hxv","PYSEC-2023-255"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0090","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-1183","published":"2024-04-16","fixed":"4.10.0","kev":false},{"cve":"CVE-2023-51449","published":"2023-12-22","fixed":"4.11.0","kev":false},{"cve":"CVE-2024-1561","published":"2024-04-16","fixed":"4.13.0","kev":false},{"cve":"CVE-2023-6572","published":"2023-12-14","fixed":"4.14.0","kev":false},{"cve":"CVE-2024-2206","published":"2024-03-27","fixed":"4.18.0","kev":false,"link":{"from":"CVE-2023-6572","to":"CVE-2024-2206","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:gradio","fromFixed":"4.14.0","toFixed":"4.18.0","daysApart":104}]}},{"cve":"CVE-2024-1727","published":"2024-03-21","fixed":"4.19.2","kev":false},{"cve":"CVE-2024-1728","published":"2024-04-10","fixed":"4.19.2","kev":false}],"package":"PyPI:gradio"}}