{"action":"Upgrade gradio to 4.29.0 or later.","affected":[{"fixed":"4.29.0","introduced":"0"}],"component":"gradio","cve_ids":["CVE-2024-4253"],"ecosystem":"PyPI","epss":0.01704,"exploited":false,"fixed_versions":["4.29.0"],"id":"tcs_01M5KGN4TNHNJTV2FBJGDH6XXF","modified_at":"2026-07-13T07:15:32.948963934Z","published_at":"2024-06-04T08:15:10.863Z","references":["https://osv.dev/vulnerability/PYSEC-2024-321","https://github.com/gradio-app/gradio/commit/a0e70366a8a406fdd80abb21e8c88a3c8e682a2b","https://huntr.com/bounties/23cb3749-8ae9-4e1a-9023-4a20ca6b675e"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"PYSEC-2024-321","url":"https://osv.dev/vulnerability/PYSEC-2024-321"}],"summary":"A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special"}