open-mmlab/powerpaint

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  model/diffusers_c/pipelines/audioldm/pipeline_audioldm.py:21
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2023-6572 Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2023-6572). Fix: Update that package to its patched version.
• Serious CVE-2024-1728 Gradio allows users to access arbitrary files
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-1728). Fix: Update that package to its patched version.
• Serious CVE-2025-23042 Gradio Blocked Path ACL Bypass Vulnerability
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2025-23042). Fix: Update that package to its patched version.
• Serious CVE-2023-6730 transformers has a Deserialization of Untrusted Data vulnerability
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2023-6730). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44513 Diffusers: Diffusers: Arbitrary remote code execution via `trust_remote_code` bypass
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2026-44513). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-45804 diffusers: Diffusers: Arbitrary code execution due to trust_remote_code guard bypass
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2026-45804). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-51449 Gradio makes the `/file` secure against file traversal and server-side request forgery attacks
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2023-51449). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-0964 Gradio Path Traversal vulnerability
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-0964). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-1561 gradio vulnerable to Path Traversal
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-1561). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-2206 gradio Server-Side Request Forgery vulnerability
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-2206). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-34510 Gradio allows credential leakage on Windows
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-34510). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-47084 Gradios's CORS origin validation is not performed when the request has a cookie
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47084). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-47867 Gradio lacks integrity checking on the downloaded FRP client
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47867). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-47870 Gradio has a race condition in update_root_in_config may redirect user traffic
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47870). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-47871 Gradio uses insecure communication between the FRP client and server
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47871). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-4941 Local file inclusion in gradio
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-4941). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-28414 Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2026-28414). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-28416 Gradio: Gradio: Server-Side Request Forgery allows access to internal services via malicious Space loading
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2026-28416). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48545 Gradio contains a cookie injection vulnerability
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2026-48545). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-1183 gradio Server-Side Request Forgery vulnerability
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-1183). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-1727 Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading files
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-1727). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-1729 Gradio apps vulnerable to timing attacks to guess password
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-1729). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-47164 Gradio's `is_in_or_equal` function may be bypassed
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47164). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-47165 Gradio's CORS origin validation accepts the null origin
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47165). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-47166 Gradio has a one-level read path traversal in `/custom_component`
  requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47166). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious PYSEC-2023-255 Command Injection in GitHub repository gradio-app/gradio prior to main.
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2023-6572). Fix: Update that package to its patched version.
• Serious PYSEC-2024-215 Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **Server-Side Request Forgery (SSRF)** in the `/queue/join` endpoint. Gradio’s `async_save_url_to_
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47167). Fix: Update that package to its patched version.
• Serious PYSEC-2024-219 Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **insecure communication** between the FRP (Fast Reverse Proxy) client and server when Gradio's `sha
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47871). Fix: Update that package to its patched version.
• Serious PYSEC-2024-274 Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is triggered via a crafted input. NOTE: the supplier disputes th
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-39236). Fix: Update that package to its patched version.
• Serious PYSEC-2024-321 A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-4253). Fix: Update that package to its patched version.
• Serious PYSEC-2025-118 Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List (ACL) f
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2025-23042). Fix: Update that package to its patched version.
• Serious PYSEC-2026-345 Gradio allows users to access arbitrary files
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-1728). Fix: Update that package to its patched version.
• Serious PYSEC-2023-300 Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2023-6730). Fix: Update that package to its patched version.
• Serious PYSEC-2026-2290 A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2026-5241). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2446 Diffusers: TOCTOU Trust Remote Code Bypass
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2026-45804). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-40 Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user pa
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2026-44513). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-41 Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trust_remote_code=True safeguard when loading pipelines from Hug
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2026-44827). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2023-249 Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2023-51449). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-184 A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the `postprocess()` function within `gra
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-4941). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-196 Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where the Gradio server fails to validate the request origin when a
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47084). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-197 Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **one-level read path traversal** in the `/custom_component` endpoint. Attackers can exploit this
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47166). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-198 Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enable_monitoring flag not properly disabling monitoring when set to False.
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47168). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-199 Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47869). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-213 Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the **bypass of directory traversal checks** within the `is_in_or_equal` function. This function,
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47164). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-214 Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **CORS origin validation accepting a null origin**. When a Gradio server is deployed locally, the
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47165). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-216 Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a **lack of integrity check** on the downloaded FRP client, which could potentially allow attackers to int
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47867). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-217 Gradio is an open-source Python package designed for quick prototyping. This is a **data validation vulnerability** affecting several Gradio components, which allows arbitrary file leaks through the p
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47868). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-218 Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **race condition** in the `update_root_in_config` function, allowing an attacker to modify the `ro
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47870). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-220 Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **Cross-Site Scripting (XSS)** on any Gradio server that allows file uploads. Authenticated users ca
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47872). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-255 Gradio before 4.20 allows credential leakage on Windows.
  /workdirs/scan-0ccddad5-6d16-4963-afa3-65dacb46aaa9/requirements/requirements.txt
  A package you depend on has a known security hole (CVE-2024-34510). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: pypi:timeout