-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gradio | pip | < 4.13.0 | 4.13.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from missing validation of the _is_server_fn attribute in the component_server route handler. The commit fix shows the vulnerable code retrieved functions via getattr(block, body.fn_name) without checking if they were intended to be server-exposed functions. The patch adds a critical check for fn._is_server_fn, and the associated test verifies that non-server functions like 'preprocess' are blocked. This demonstrates the original function lacked proper access control for component methods.
PythonPythonOngoing coverage of React2Shell