CVE-2024-10569
Gradio Project Gradio 2024-09-18
Raw vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2024-10569 is a high-severity Undefined Behavior for Input to API (CWE-475) vulnerability in Gradio Project Gradio. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 46th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Machine Learning Libraries; in the Data-Related Vulnerabilities risk domain.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7112
Vulnerability Data
A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process input values, which can accept compressed files. An attacker can exploit this by uploading a maliciously crafted…
more
zip bomb, leading to a server crash and causing a denial of service.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Machine Learning Libraries
- Risk Domain
- Data-Related Vulnerabilities
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: gradio
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover calls that supply invalid control-parameter values before deployment.
Validating inputs to API control parameters ensures only permitted values are supplied, structurally eliminating the source of undefined behavior.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect undefined behavior from invalid API inputs before deployment.
Secure development lifecycle includes API specification and validation that can prevent undefined behavior from invalid inputs.
Application security requirements can mandate explicit input validation and defined behavior for API parameters.
Secure system architecture principles can require defensive coding that eliminates undefined behavior in APIs.
Secure coding directly addresses avoiding undefined behavior by enforcing defined inputs and error handling in APIs.