{"action":"Upgrade gradio to 4.31.4 or later.","affected":[{"fixed":"4.31.4","introduced":"0"}],"component":"gradio","cve_ids":["CVE-2024-4941"],"ecosystem":"PyPI","epss":0.0083,"exploited":false,"fixed_versions":["4.31.4"],"ghsa_id":"GHSA-6v6g-j5fq-hpvw","id":"tcs_01M5KGMB9KBGQ4X8QTQTMQZAYH","modified_at":"2026-06-10T17:01:21.040668281Z","published_at":"2024-06-06T18:15:18Z","references":["https://osv.dev/vulnerability/PYSEC-2024-184","https://huntr.com/bounties/39889ce1-298d-4568-aecd-7ae40c2ca58e","https://github.com/gradio-app/gradio/commit/ee1e2942e0a1ae84a08a05464e41c8108a03fa9c","https://github.com/advisories/GHSA-6v6g-j5fq-hpvw"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2024-184","url":"https://osv.dev/vulnerability/PYSEC-2024-184"}],"summary":"A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the `postprocess()` function within `gra"}