github.com/dwzhu-pku/PaperBanana
Submitted 6/10/2026, 1:59:08 AM · Status: ok
Risk grade
F
100 / 100
Findings
29
0 critical4 high24 medium1 low0 info0 on CISA KEV0ATT&CK
Showing 29 of 29 findings
Findings
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. EnsurBy not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.semgrep/tmp/scan-psc_5d8dae337c43858c1f46147f61226d5b/repo/Dockerfile:21
- Image user should not be 'root'Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.trivyDockerfile:0
- Ensure that a user for the container has been createdEnsure that a user for the container has been created on /Dockerfile.checkovDockerfile:1
- Ensure that HEALTHCHECK instructions have been added to container imagesEnsure that HEALTHCHECK instructions have been added to container images on /Dockerfile.checkovDockerfile:1
- Gradio Allows Unauthorized File Copy via Path ManipulationAn arbitrary file copy vulnerability in Gradio's flagging feature allows unauthenticated attackers to copy any readable file from the server's filesystem. While attackers can't read these copied files, they can cause DoS by copying large files (like /dev/urandom) to fill disk spa…osv-scanner
- Gradio Blocked Path ACL Bypass Vulnerability## Summary Gradio's Access Control List (ACL) for file paths can be bypassed by altering the letter case of a blocked file or directory path. This vulnerability arises due to the lack of case normalization in the file path validation logic. On case-insensitive file systems, such…osv-scanner
- Gradio CORS Origin Validation Bypass VulnerabilityA vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function is_valid_origin of the component CORS Handler. The manipulation of the argument localhost_aliases leads to origin validation error. It is possible to initiate the…osv-scanner
- Gradio DOS in multipart boundry while uploading the fileA vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 allows for a Denial of Service (DoS) attack. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously process each charac…osv-scanner
- Gradio has an Open Redirect in its OAuth Flow# Summary The _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback endpoints on Gradio apps with OAuth enabled (i.e. apps running on…osv-scanner
- Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing### Summary A Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victim application uses `gr.load()` to load an attacker-controlled Space, the malicious …osv-scanner
- Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+### Summary Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitrary files from the file system. ### Details Python 3.13+ changed the definition of `os.path.isabs` so that root-rel…osv-scanner
- Gradio Path Traversal vulnerabilityA vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path functionality, which is intended to disallow users from reading certain files, is flawed. Specifically, while the application …osv-scanner
- Gradio vulnerable to arbitrary file read with File and UploadButton components### Summary If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary files from the application server. ### Details Consider the following applic…osv-scanner
- Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret## Summary Gradio applications running outside of Hugging Face Spaces automatically enable "mocked" OAuth routes when OAuth components (e.g. `gr.LoginButton`) are used. When a user visits `/login/huggingface`, the server retrieves its own Hugging Face access token via `huggingfa…osv-scanner
- PYSEC-2024-275Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to re…osv-scanner
- PYSEC-2025-118Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List (ACL) for file paths can be bypassed by altering the letter case of a blocked file or d…osv-scanner
- PYSEC-2026-63Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable "mocked" OAuth routes when OAuth components (e.g. `gr.LoginButton`) are u…osv-scanner
- PYSEC-2026-64Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitrary files from the file system. Py…osv-scanner
- PYSEC-2026-65Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter, allowing redirection to arbitrary external URLs. This affects the /logout …osv-scanner
- PYSEC-2026-66Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victi…osv-scanner
- Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluDetected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.semgrep/tmp/scan-psc_5d8dae337c43858c1f46147f61226d5b/repo/agents/visualizer_agent.py:46
- Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluDetected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.semgrep/tmp/scan-psc_5d8dae337c43858c1f46147f61226d5b/repo/agents/vanilla_agent.py:52
- This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible.semgrep/tmp/scan-psc_5d8dae337c43858c1f46147f61226d5b/repo/index.html:408
- This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered withoThis tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify th…semgrep/tmp/scan-psc_5d8dae337c43858c1f46147f61226d5b/repo/index.html:17
- This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered withoThis tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify th…semgrep/tmp/scan-psc_5d8dae337c43858c1f46147f61226d5b/repo/index.html:23
- This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered withoThis tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify th…semgrep/tmp/scan-psc_5d8dae337c43858c1f46147f61226d5b/repo/index.html:18
- No HEALTHCHECK definedYou should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.trivyDockerfile:0
This report is public.