Gradio-App Gradio vulnerabilities

CVE-2024-47872 [MEDIUM] CWE-79 CVE-2024-47872: Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **Cross-Site Scripting (XSS)** on any Gradio server that allows file uploads. Authenticated users can upload files such as HTML, JavaScript, or SVG files containing malicious scripts. When other users download or view these files, the scripts will execu

CVE-2026-28415 [MEDIUM] CWE-200 CVE-2026-28415: Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback endpoints on Gradio apps with OAuth enabled (i.e. ap

CVE-2024-47168 [MEDIUM] CWE-670 CVE-2024-47168: Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enable_monitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access the monitoring dashboard by directly requesting the /mon

CVE-2025-5320 [LOW] CWE-345 CVE-2025-5320: A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This aff A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function is_valid_origin of the component CORS Handler. The manipulation of the argument localhost_aliases leads to erweiterte Rechte. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability i

CVE-2024-47869 [LOW] CWE-203 CVE-2024-47869: Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash

CVE-2026-10783 [LOW] CWE-327 CVE-2026-10783: A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audi A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Performing a manipulation results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high complexity. It is indicated that the exploitability is d