CVE-2024-0964 — CRITICAL (CVSS 9.4) AI Security Vulnerability

CISO Take

Any internet-exposed Gradio instance is vulnerable to unauthenticated arbitrary file read — attackers send a crafted JSON payload to the API and can retrieve model weights, environment files, API keys, and training data. CVSS 9.4 with no auth required means blast radius is immediate and total for exposed deployments. Patch to a fixed version now; if you cannot patch, firewall Gradio API endpoints and treat any public-facing instance as potentially compromised.

Risk Assessment

Critically high. The attack requires no authentication, no user interaction, and is trivially exploitable from the internet. Gradio is ubiquitously deployed in ML teams for model demos, internal tooling, and Hugging Face Spaces — the attack surface is massive. Exploitation does not require AI/ML knowledge, only the ability to send an HTTP request with a path traversal string in a JSON body. In ML environments, servers typically co-locate model weights, training data, cloud credentials, and .env files — all directly accessible via this vulnerability.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
gradio	pip	—	No patch
42.5K OpenSSF 5.6 674 dependents Pushed 8d ago 27% patched ~110d to patch Full package profile →

Do you use gradio? You're affected.

Severity & Risk

CVSS 3.1

9.4 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A Low

Recommended Action

6 steps

Patch: Upgrade Gradio to the version containing commit d76bcaaaf073 (check GitHub advisory for minimum safe version).
Network controls: If immediate patching is not possible, restrict Gradio API access to trusted IP ranges or put behind authenticated reverse proxy.
Detection: Search web/app server logs for path traversal patterns in JSON bodies (../../../, %2e%2e%2f, etc.) directed at Gradio API endpoints.
Secrets rotation: If Gradio was publicly exposed prior to patching, rotate all credentials that were present on the host — API keys, cloud credentials, service tokens.
Audit exposure: Enumerate all Gradio instances via internal asset inventory; assume any public instance without patching confirmation has been read-accessed.
Hugging Face Spaces: If using HF Spaces with Gradio, verify HF has applied the patch or redeploy spaces with updated Gradio version.

CISA SSVC Assessment

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Data Extraction Data Leakage Auth Bypass Framework Inference API AML.T0007 - Discover AI Artifacts AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials

Compliance Impact

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.5 - Security of AI system

NIST AI RMF

MANAGE-2.4 - Residual risks are managed

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2024-0964?

Any internet-exposed Gradio instance is vulnerable to unauthenticated arbitrary file read — attackers send a crafted JSON payload to the API and can retrieve model weights, environment files, API keys, and training data. CVSS 9.4 with no auth required means blast radius is immediate and total for exposed deployments. Patch to a fixed version now; if you cannot patch, firewall Gradio API endpoints and treat any public-facing instance as potentially compromised.

Is CVE-2024-0964 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2024-0964, increasing the risk of exploitation.

How to fix CVE-2024-0964?

1. Patch: Upgrade Gradio to the version containing commit d76bcaaaf073 (check GitHub advisory for minimum safe version). 2. Network controls: If immediate patching is not possible, restrict Gradio API access to trusted IP ranges or put behind authenticated reverse proxy. 3. Detection: Search web/app server logs for path traversal patterns in JSON bodies (../../../, %2e%2e%2f, etc.) directed at Gradio API endpoints. 4. Secrets rotation: If Gradio was publicly exposed prior to patching, rotate all credentials that were present on the host — API keys, cloud credentials, service tokens. 5. Audit exposure: Enumerate all Gradio instances via internal asset inventory; assume any public instance without patching confirmation has been read-accessed. 6. Hugging Face Spaces: If using HF Spaces with Gradio, verify HF has applied the patch or redeploy spaces with updated Gradio version.

What systems are affected by CVE-2024-0964?

This vulnerability affects the following AI/ML architecture patterns: model serving, ML development environments, AI prototype APIs, inference endpoints.

What is the CVSS score for CVE-2024-0964?

CVE-2024-0964 has a CVSS v3.1 base score of 9.4 (CRITICAL). The EPSS exploitation probability is 0.15%.

Technical Details

NVD Description

A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.

Exploitation Scenario

An adversary scanning for ML tooling endpoints discovers a public-facing Gradio demo endpoint (common on ports 7860/7861 or via Hugging Face Spaces). They send a POST request to the Gradio API with a JSON payload containing a path traversal string targeting sensitive files (e.g., ../../../../etc/passwd, then ../../../../app/.env). The server returns file contents directly. The attacker enumerates common ML environment paths to extract: Hugging Face tokens (used to download/push private models), OpenAI or Anthropic API keys (for billing abuse or prompt injection at scale), AWS/GCP credentials (for cloud pivot), and proprietary model weights or fine-tuning datasets. If the Gradio instance runs in a container with mounted secrets, the exfiltration is immediate and requires no further exploitation steps.