2 rules
Gradio Path Traversal vulnerability
A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.
OWASP A01OWASP LLM
Get guardrail →
Threat Intelligence
Live CVE feed521 threats tracked across 12 launch stacks — sourced from NVD, GHSA, CISA KEV, OSV, npm Audit, and EPSS.
Stack exposure — click to filter✕ Clear stack filter
66threats · AI / LLM Apps · High· page 4/4
Get guardrails →2 rules
Gradio makes the `/file` secure against file traversal and server-side request forgery attacks
Older versions of gradio contained a vulnerability in the /file route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with share=True, or on Hugging Face Spaces) if they knew the path of files to look for. This was not possible through regular URLs passed into a browser, but it was possible through the use of programmatic tools such as curl with the --pass-as-is flag. Furthermore, the /file route in Gradio apps also contained a vulnerability that made it possible to use it for SSRF attacks. Both of these vulnerabilities have been fixed in gradio==4.11.0
OWASP A01OWASP LLM
Get guardrail →2 rules
transformers has a Deserialization of Untrusted Data vulnerability
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
OWASP A08LLM05 · Supply ChainOWASP LLM
Get guardrail →2 rules
Langchain Server-Side Request Forgery vulnerability
In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.
OWASP A03OWASP A10LLM02 · Insecure OutputOWASP LLM
Get guardrail →2 rules
LangChain Server Side Request Forgery vulnerability
LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.
OWASP A10LLM02 · Insecure OutputOWASP LLM
Get guardrail →2 rules
langchain SQL Injection vulnerability
SQL injection vulnerability in langchain allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.
OWASP A03OWASP LLM
Get guardrail →Showing 61–66 of 66 threats