Gradio Project vulnerabilities

Products

• Gradio 50

Newest

• gradio-app gradio Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess() CVE-2026-49119 Fix available 8.7 HighJuly 1, 2026
• gradio-app gradio gradio-app gradio Audio Cache Key save_audio_to_cache weak hash CVE-2026-10783 Fix available 2.0 LowJune 3, 2026
• gradio-app gradio Gradio < 6.15.0 Cookie Injection via Shared Proxy Client CVE-2026-48545 Fix available 7.6 HighMay 27, 2026
• gradio-app gradio Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing CVE-2026-28416 Fix available 8.2 HighFebruary 27, 2026
• gradio-app gradio Gradio has Open Redirect in OAuth Flow CVE-2026-28415 Fix available 4.3 MediumFebruary 27, 2026
• gradio-app gradio Gradio has Absolute Path Traversal on Windows with Python 3.13+ CVE-2026-28414 Fix available 7.5 HighFebruary 27, 2026
• gradio-app gradio Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret CVE-2026-27167 Fix available 0.0 NoneFebruary 27, 2026
• gradio-app gradio Gradio Allows Unauthorized File Copy via Path Manipulation CVE-2025-48889 Fix available 5.3 MediumMay 29, 2025
• gradio-app gradio-app/gradio, gradio project gradio +1 more Open Redirect in gradio-app/gradio CVE-2024-8021 5.4 MediumMarch 20, 2025
• gradio-app gradio-app/gradio, gradio project gradio +1 more Path Traversal in gradio-app/gradio CVE-2024-10648 8.2 HighMarch 20, 2025
• gradio-app gradio-app/gradio, gradio project gradio +1 more Zip Bomb Vulnerability in gradio-app/gradio CVE-2024-10569 7.5 HighMarch 20, 2025
• gradio-app gradio-app/gradio, gradio project gradio +1 more Regular Expression Denial of Service (ReDoS) in gradio-app/gradio CVE-2024-10624 7.5 HighMarch 20, 2025
• gradio-app gradio-app/gradio, gradio project gradio +1 more Denial of Service (DoS) by Sending Large Filename at File Upload Endpoint in gradio-app/gradio CVE-2025-0187 7.5 HighMarch 20, 2025
• gradio-app gradio Gradio Blocked Path ACL Bypass Vulnerability CVE-2025-23042 Fix available 8.7 HighJanuary 14, 2025
• gradio-app gradio Arbitrary file read with File and UploadButton components in Gradio CVE-2024-51751 Fix available 6.5 MediumNovember 6, 2024
• gradio project gradio gradio Server Side Request Forgery vulnerability CVE-2024-48052 6.5 MediumNovember 4, 2024
• gradio-app gradio Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files CVE-2024-47872 Fix available 6.9 MediumOctober 10, 2024
• gradio-app gradio Insecure communication between the FRP client and server in Gradio CVE-2024-47871 Fix available 8.2 HighOctober 10, 2024
• gradio-app gradio Race condition in update_root_in_config may redirect user traffic in Gradio CVE-2024-47870 Fix available 7.1 HighOctober 10, 2024
• gradio-app gradio Non-constant-time comparison when comparing hashes in Gradio CVE-2024-47869 Fix available 2.3 LowOctober 10, 2024
• gradio-app gradio Several components’ post-process steps may allow arbitrary file leaks in Gradio CVE-2024-47868 Fix available 6.3 MediumOctober 10, 2024
• gradio-app gradio Lack of integrity check on the downloaded FRP client in Gradio CVE-2024-47867 Fix available 2.1 LowOctober 10, 2024
• gradio-app gradio SSRF in the path parameter of /queue/join in Gradio CVE-2024-47167 Public exploitFix available 6.9 MediumOctober 10, 2024
• gradio-app gradio The `enable_monitoring` flag set to `False` does not disable monitoring in Gradio CVE-2024-47168 Fix available 2.3 LowOctober 10, 2024
• gradio-app gradio One-level read path traversal in `/custom_component` in Gradio CVE-2024-47166 Fix available 2.3 LowOctober 10, 2024
• gradio-app gradio CORS origin validation accepts the null origin in Gradio CVE-2024-47165 Fix available 6.9 MediumOctober 10, 2024
• gradio-app gradio The `is_in_or_equal` function may be bypassed in Gradio CVE-2024-47164 Fix available 2.3 LowOctober 10, 2024
• gradio-app gradio CORS origin validation is not performed when the request has a cookie in Gradio CVE-2024-47084 Fix available 6.9 MediumOctober 10, 2024
• gradio project gradio Withdrawn Advisory: Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py CVE-2024-39236 Disputed 9.8 CriticalJuly 1, 2024
• gradio-app gradio-app/gradio, gradio project gradio +1 more Open Redirect in gradio-app/gradio CVE-2024-4940 5.4 MediumJune 22, 2024
• gradio-app gradio-app/gradio, gradio project gradio +1 more Server-Side Request Forgery (SSRF) in gradio-app/gradio CVE-2024-4325 EPSS 37.1% 8.6 HighJune 6, 2024
• gradio-app gradio-app/gradio, gradio project gradio +1 more Local File Inclusion in JSON component in gradio-app/gradio CVE-2024-4941 Fix available 7.5 HighJune 6, 2024
• gradio-app gradio-app/gradio, gradio project gradio +1 more Secrets Exfiltration in gradio-app/gradio CVE-2024-4254 Public exploit 7.1 HighJune 4, 2024
• gradio-app gradio-app/gradio, gradio project gradio +1 more Command Injection in gradio-app/gradio CVE-2024-4253 Public exploitFix available 7.5 HighJune 4, 2024
• gradio project gradio Gradio allows credential leakage on Windows CVE-2024-34510 Fix available 7.5 HighMay 5, 2024
• gradio-app gradio-app/gradio, gradio project gradio +1 more Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio CVE-2024-1561 Public exploitFix available 7.5 HighApril 16, 2024
• gradio-app gradio-app/gradio, gradio project gradio +1 more SSRF Vulnerability in gradio-app/gradio CVE-2024-1183 Fix available 6.5 MediumApril 16, 2024
• gradio-app gradio-app/gradio, gradio project gradio +1 more Local File Inclusion in gradio-app/gradio CVE-2024-1728 Fix available EPSS 85.4% 7.5 HighApril 10, 2024
• gradio-app gradio-app/gradio, gradio app gradio +1 more Command Injection in gradio-app/gradio via deploy+test-visual.yml workflow CVE-2024-1540 Public exploit 8.6 HighMarch 27, 2024
• gradio-app gradio-app/gradio, gradio project gradio +1 more SSRF Vulnerability in gradio-app/gradio CVE-2024-2206 Fix available 7.3 HighMarch 27, 2024
• gradio-app gradio-app/gradio, gradio project gradio +1 more CSRF Vulnerability in gradio-app/gradio CVE-2024-1727 Fix available 4.3 MediumMarch 21, 2024
• gradio-app gradio-app/gradio, gradio project gradio +1 more Timing Attack Vulnerability in gradio-app/gradio CVE-2024-1729 Fix available 5.9 MediumFebruary 22, 2024
• gradio app gradio, gradio-app gradio-app/gradio +1 more LFI in Gradio CVE-2024-0964 Fix available 7.5 HighFebruary 5, 2024
• gradio-app gradio Make the `/file` secure against file traversal attacks CVE-2023-51449 Fix available EPSS 28.3% 5.6 MediumDecember 21, 2023
• gradio-app gradio-app/gradio, gradio project gradio +1 more Command Injection in gradio-app/gradio CVE-2023-6572 Public exploitFix available 9.6 CriticalDecember 14, 2023
• gradio project gradio Gradio arbitrary file upload vulnerability CVE-2023-41626 4.8 MediumSeptember 15, 2023
• gradio-app gradio Unfiltered paths in gradio CVE-2023-34239 Fix available 7.3 HighJune 7, 2023
• gradio-app gradio Gradio contains Use of Hard-coded Credentials CVE-2023-25823 Fix available 5.4 MediumFebruary 23, 2023
• gradio-app gradio Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging CVE-2022-24770 Fix available 8.8 HighMarch 17, 2022
• gradio-app gradio Files on the host computer can be accessed from the Gradio interface CVE-2021-43831 Fix available 7.7 HighDecember 15, 2021