GHSA-4m3g-6r7g-jv4f: Arbitrary JavaScript execution due to using outdated libraries

June 5, 2024

gradio-pdf projects with dependencies on the pdf.js library are vulnerable to CVE-2024-4367, which allows arbitrary JavaScript execution.

References

github.com/advisories/GHSA-4m3g-6r7g-jv4f
github.com/freddyaboulton/gradio-pdf
github.com/freddyaboulton/gradio-pdf/commit/67edd0c625fae7b855186727ee9678297602ee45
github.com/freddyaboulton/gradio-pdf/security/advisories/GHSA-4m3g-6r7g-jv4f

Code Behaviors & Features

Detect and mitigate GHSA-4m3g-6r7g-jv4f with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →