Spaces:

---

julien-c

/

coqui

Like 31

Running on CPU Upgrade

The Space currently pins sdk_version: 2.2.15. Gradio versions this old expose the /file endpoint path-traversal and SSRF issues that were fixed from 4.13 onwards. An external scanner reached this Space during a sweep of the Hub and succeeded in reading /etc/passwd through the web handler, so this is confirmed exploitable rather than theoretical.

This PR moves the Space to gradio 4.44.1, the last 4.x release, which still declares requires_python >= 3.8. That keeps the existing python_version: 3.8 and the pinned TTS==0.2.1 untouched, which gradio 5 would not allow (it needs >= 3.10).

The 2.x component API was removed in gradio 4, so the interface needed updating as well:

• gr.inputs.Textbox(default=...) becomes gr.Textbox(value=...)
• gr.inputs.Radio(...) becomes gr.Radio(...)
• gr.outputs.Audio(...) becomes gr.Audio(...)
• theme="huggingface" is dropped, the named themes were removed in 4.x

The TTS logic is unchanged. Please run a build before merging: TTS==0.2.1 and Werkzeug==2.0.3 are old pins and I could not verify the image builds against the newer gradio.

Raised from infrastructure security triage, Nightwatch ticket 112155.