Gradio Zip Bomb Vulnerability in Dataframe Component Allowing Denial-of-Service

A denial-of-service vulnerability has been identified in the dataframe component of Gradio (version git 98cbcae). This issue arises from the component's use of pd.read_csv to process input values, which can accept compressed files. An attacker could exploit this by uploading a maliciously crafted zip bomb, leading to a server crash.

Impact

Exploitation of this vulnerability causes the Gradio server to crash, terminating the process and disrupting service.

Reproduction

The vulnerability can be reproduced by creating a zip bomb—such as a gzip file that expands to a large size— and uploading it through a Gradio interface that accepts CSV files. The server will crash due to the excessive memory consumption.