CVE-2024-47166: 
Gradio vulnerability analysis and mitigation

Gradio, an open-source Python package designed for quick prototyping, contains a one-level read path traversal vulnerability (CVE-2024-47166) in the /custom_component endpoint. The vulnerability was discovered and disclosed on October 10, 2024, affecting all versions of Gradio prior to version 4.44.0 (GitHub Advisory).

The vulnerability is classified as a path traversal issue (CWE-22) that allows attackers to manipulate file paths in requests to the /custom_component endpoint. The traversal is limited to a single directory level, with a CVSS v3.1 base score of 5.3 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

When exploited, this vulnerability could allow attackers to access and leak source code from custom Gradio components that developers intended to keep private. This particularly affects users who have developed custom Gradio components and are hosting them on publicly accessible servers (GitHub Advisory).

Users are strongly advised to upgrade to Gradio version 4.44.0 or later to address this vulnerability. As a temporary workaround, developers can sanitize file paths and ensure that components are not stored in publicly accessible directories (GitHub Advisory).