PyPi: Inference

CVE-2024-47831

Transitive

Safety vulnerability ID: 74693

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Oct 14, 2024 Updated at Jan 31, 2025
Scan your Python projects for vulnerabilities →

Advisory

Inference addresses CVE-2024-47831 by updating next from 14.2.12 to 15.1.1 in /inference/landing.

Affected package

inference

Latest version: 0.36.1

With no prior knowledge of machine learning or device-specific deployment, you can deploy a computer vision model to a range of devices and environments using Roboflow Inference.

Affected versions

Fixed versions

Vulnerability changelog

🚀 Added
👀 Gaze detection in Workflows

<table>
<tr>
<td width="35%"><img src="https://github.com/user-attachments/assets/5e4d1a8f-1b74-495c-afa3-be48d9696d48" /></td>
<td width="65%"><img src="https://github.com/user-attachments/assets/26c65bf3-e44a-404e-8348-318654cf5520" /></td>
</tr>
</table>

joaomarcoscrs (as part of hist first contribution 🏅) introduced Gaze detection model into Workflows.

Don't know what Gaze Detection is?

Gaze detection is a method to determine where a person is looking by analyzing their eye movements and gaze direction. It typically uses cameras or sensors to track eye position and orientation, identifying the point of focus in real time.

It is commonly used in areas like:

* **Human-Computer Interaction**: Controlling devices with eye movements.
* **Behavioral Analysis:** Understanding attention and interest.
* **Marketing Research:** Measuring what catches a person's attention.

Now - you can apply Workflows in such use-cases. Check out Gaze Detection block [📖 documentation](https://inference.roboflow.com/workflows/blocks/gaze_detection/) to find more information.

> [!NOTE]
> The block is currently not supported on Roboflow Hosted Platform. Check out how to [send requests to localhost `inference` server](https://inference.roboflow.com/workflows/modes_of_running/#http-api-request)

🏋️‍♂️ New experimental Workflows blocks enabling new capabilities

yeldarby prepared whole series of blocks to open-up new capabilities for Workflows, including:
* [Workflows Buffer Block](https://inference.roboflow.com/workflows/blocks/buffer/) in https://github.com/roboflow/inference/pull/894
* [Workflows Grid Visualization Block](https://inference.roboflow.com/workflows/blocks/grid_visualization/) in https://github.com/roboflow/inference/pull/895
* Workflow Cache [Get](https://inference.roboflow.com/workflows/blocks/cache_get/)/[Set Blocks](https://inference.roboflow.com/workflows/blocks/cache_set/) in https://github.com/roboflow/inference/pull/893
* Workflows [Outlier Detection Block](https://inference.roboflow.com/workflows/blocks/identify_outliers/) in https://github.com/roboflow/inference/pull/896


💪 Improved

`Florence 2` runs now up to 3x faster
🧙‍♂️ isaacrob-roboflow did some magic 🪄 and now, all of the sudden `Florence2` models deployed in `inference` could run up to 3x faster 🤯 ❗
See details in https://github.com/roboflow/inference/pull/885


🔧 Fixed

Security vulnerability in landing page
We've fixed security issue in `inference` server landing page: https://github.com/roboflow/inference/pull/890

Issue description
If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.
This issue was patched in Next.js `14.2.15` and later.

> [!CAUTION]
> We advise all users of older versions of `inference` server to migrate to version `0.32.0`

Other fixes
* Add fix for the problem with inference-cli workflows predictions saving by PawelPeczek-Roboflow in https://github.com/roboflow/inference/pull/891
* Improvements in blocks descriptions' by EmilyGavrilenko (https://github.com/roboflow/inference/pull/898) and casmwenger in (https://github.com/roboflow/inference/pull/897)
* Fix usage collector fps by grzegorz-roboflow in https://github.com/roboflow/inference/pull/903

🚧 What's Changed
* Add test to detect blocks with missing __init__.py by grzegorz-roboflow in https://github.com/roboflow/inference/pull/883
* Cache CLIP Text Embeddings in Workflow Block by yeldarby in https://github.com/roboflow/inference/pull/892
* Allow using video metadata for rate limiter on recorded video by yeldarby in https://github.com/roboflow/inference/pull/887
* Serialized owlv2 model by probicheaux in https://github.com/roboflow/inference/pull/889
* Skip additional test by PawelPeczek-Roboflow in https://github.com/roboflow/inference/pull/902

🏅 New Contributors
* joaomarcoscrs made their first contribution in https://github.com/roboflow/inference/pull/888

**Full Changelog**: https://github.com/roboflow/inference/compare/v0.31.1...v0.32.0

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application

Severity Details

CVSS Base Score

HIGH 7.5

CVSS v3 Details

HIGH 7.5
Attack Vector (AV)
NETWORK
Attack Complexity (AC)
LOW
Privileges Required (PR)
NONE
User Interaction (UI)
NONE
Scope (S)
UNCHANGED
Confidentiality Impact (C)
NONE
Integrity Impact (I)
NONE
Availability Availability (A)
HIGH