CVE-2023-6572: False positive

December 14, 2023 (updated February 8, 2024)

This advisory has been marked as a False Positive and has been removed. CVE-2023-6572 is a GitHub Actions expression injection vulnerability in the gradio project’s CI workflow file (.github/workflows/generate-changeset.yml). It affects the project’s CI/CD infrastructure only, not the gradio library distributed via PyPI. The fix commit (5b5af18) removes an unquoted echo expression from a workflow file and has no impact on any released version of the gradio package.

References

github.com/gradio-app/gradio/commit/5b5af1899dd98d63e1f9b48a93601c2db1f56520
huntr.com/bounties/21d2ff0c-d43a-4afd-bb4d-049ee8da5b5c
nvd.nist.gov/vuln/detail/CVE-2023-6572

Code Behaviors & Features

Detect and mitigate CVE-2023-6572 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →