SOURCE-LINKED INTELLIGENCE
GHSA-7xmc-vhjp-qv5q: Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb
A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process input values, which can accept compressed files. An attacker can exploit this by uploading a maliciously crafted zip bomb, leading to a server crash and causing a denial of service.
Read original source ↗ Open in workspace
- recordType
- vulnerability
- status
- active
- evidenceStatus
- reported
- region
- Global
Evidence & attribution
- OSV AI package advisories · 2025-03-20T12:32:39.000Z
- OSV AI package advisories · 2026-07-07T14:34:51.623Z
First collected: 2026-09-19T20:28:21.856Z. This is not the publication date.