CVE-2024-10569: Gradio Project Gradio

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process input values, which can accept compressed files. An attacker can exploit this by uploading a maliciously crafted zip bomb, leading to a server crash and causing a denial of service.

Affected products

• Gradio Project Gradio: version 2024-09-18 only

Published 2025-03-20. Last modified 2026-06-17.