gradio

UNKNOWN

PyPI

CVE-2024-34510

CVE-2024-34510

May 5, 2024

CRITICAL 9.4

PyPI

CVE-2024-0964

CVE-2024-0964

Feb 5, 2024

HIGH 7.5

PyPI

CVE-2024-4941

CVE-2024-4941

Jun 6, 2024

HIGH 8.1

PyPI

CVE-2023-6572

CVE-2023-6572

Dec 14, 2023

MEDIUM 4.3

PyPI

CVE-2026-28415

Gradio has an Open Redirect in its OAuth Flow

Mar 1, 2026

HIGH 8.2

PyPI

CVE-2026-28416

Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing

Mar 1, 2026

HIGH 7.5

PyPI

CVE-2026-28414

Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+

Mar 1, 2026

CRITICAL 9.8

PyPI

CVE-2024-39236

Withdrawn Advisory: Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py

Jul 1, 2024

MEDIUM 5.3

PyPI

CVE-2025-48889

Gradio Allows Unauthorized File Copy via Path Manipulation

May 29, 2025

UNKNOWN

PyPI

CVE-2025-23042

Gradio Blocked Path ACL Bypass Vulnerability

Jan 14, 2025

NONE 0.0

PyPI

CVE-2024-51751

Gradio vulnerable to arbitrary file read with File and UploadButton components

Nov 6, 2024

NONE 0.0

PyPI

CVE-2026-27167

Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret

Mar 1, 2026

CRITICAL 9.8

PyPI

CVE-2024-39236

CVE-2024-39236

Jul 1, 2024

HIGH 8.6

PyPI

CVE-2026-28416

CVE-2026-28416

Feb 27, 2026

MEDIUM 4.7

PyPI

CVE-2026-28415

CVE-2026-28415

Feb 27, 2026

HIGH 7.5

PyPI

CVE-2026-28414

CVE-2026-28414

Feb 27, 2026

MEDIUM 5.9

PyPI

CVE-2026-27167

CVE-2026-27167

Feb 27, 2026

HIGH 7.5

PyPI

CVE-2025-48889

CVE-2025-48889

May 30, 2025

HIGH 7.5

PyPI

CVE-2025-23042

CVE-2025-23042

Jan 14, 2025

MEDIUM 6.5

PyPI

CVE-2024-51751

CVE-2024-51751

Nov 6, 2024

HIGH 7.5

PyPI

CVE-2024-0964

Gradio Path Traversal vulnerability

Feb 6, 2024

HIGH 8.3

PyPI

CVE-2021-43831

Files on the host computer can be accessed from the Gradio interface

Jan 21, 2022

HIGH 8.1

PyPI

CVE-2024-1728

Gradio allows users to access arbitrary files

Sep 25, 2024

HIGH 7.5

PyPI

CVE-2024-1728

Duplicate Advisory: Gradio Local File Inclusion vulnerability

Apr 10, 2024

HIGH 7.5

PyPI

CVE-2024-8966

Gradio DOS in multipart boundry while uploading the file

Mar 20, 2025

HIGH 7.5

PyPI

CVE-2024-10624

Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

Mar 20, 2025

HIGH 7.5

PyPI

CVE-2024-4941

Local file inclusion in gradio

Jun 6, 2024

HIGH 7.5

PyPI

CVE-2024-34510

Gradio allows credential leakage on Windows

May 5, 2024

LOW 3.7

PyPI

CVE-2025-5320

Gradio CORS Origin Validation Bypass Vulnerability

May 29, 2025

MEDIUM 5.4

PyPI

CVE-2024-8021

Gradio Vulnerable to Open Redirect

Mar 20, 2025

MEDIUM 5.3

PyPI

CVE-2024-12217

Gradio Path Traversal vulnerability

Mar 20, 2025

HIGH 8.2

PyPI

CVE-2024-10648

Gradio Vulnerable to Arbitrary File Deletion

Mar 20, 2025

HIGH 7.5

PyPI

CVE-2024-10569

Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb

Mar 20, 2025

HIGH 7.3

PyPI

CVE-2023-34239

Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs

Jun 9, 2023

LOW 3.7

PyPI

CVE-2024-47869

Gradio performs a non-constant-time comparison when comparing hashes

Oct 10, 2024

HIGH 7.2

PyPI

CVE-2024-47167

Gradio vulnerable to SSRF in the path parameter of /queue/join

Oct 10, 2024

MEDIUM 4.3

PyPI

CVE-2024-47168

In Gradio, the `enable_monitoring` flag set to `False` does not disable monitoring

Oct 10, 2024

MEDIUM 6.5

PyPI

CVE-2024-47164

Gradio's `is_in_or_equal` function may be bypassed

Oct 10, 2024

HIGH 8.8

PyPI

CVE-2024-47084

Gradios's CORS origin validation is not performed when the request has a cookie

Oct 10, 2024

MEDIUM 5.4

PyPI

CVE-2024-47165

Gradio's CORS origin validation accepts the null origin

Oct 10, 2024

MEDIUM 5.3

PyPI

CVE-2024-47166

Gradio has a one-level read path traversal in `/custom_component`

Oct 10, 2024

MEDIUM 5.3

PyPI

CVE-2024-47868

Gradio has several components with post-process steps allow arbitrary file leaks

Oct 10, 2024

HIGH 7.5

PyPI

CVE-2024-47867

Gradio lacks integrity checking on the downloaded FRP client

Oct 10, 2024

MEDIUM 5.4

PyPI

CVE-2024-47872

Gradio has an XSS on every Gradio server via upload of HTML files, JS files, or SVG files

Oct 10, 2024

HIGH 8.1

PyPI

CVE-2024-47871

Gradio uses insecure communication between the FRP client and server

Oct 10, 2024

HIGH 7.0

PyPI

CVE-2024-47870

Gradio has a race condition in update_root_in_config may redirect user traffic

Oct 10, 2024

CRITICAL 9.1

PyPI

CVE-2024-47871

CVE-2024-47871

Oct 10, 2024

HIGH 7.5

PyPI

CVE-2024-47868

CVE-2024-47868

Oct 10, 2024

HIGH 8.1

PyPI

CVE-2024-47870

CVE-2024-47870

Oct 10, 2024

MEDIUM 5.4

PyPI

CVE-2024-47165

CVE-2024-47165

Oct 10, 2024

MEDIUM 5.4

PyPI

CVE-2024-47872

CVE-2024-47872

Oct 10, 2024

MEDIUM 6.5

PyPI

CVE-2024-47164

CVE-2024-47164

Oct 10, 2024

HIGH 7.5

PyPI

CVE-2024-47867

CVE-2024-47867

Oct 10, 2024

CRITICAL 9.8

PyPI

CVE-2024-47167

CVE-2024-47167

Oct 10, 2024

MEDIUM 5.3

PyPI

CVE-2024-47166

CVE-2024-47166

Oct 10, 2024

LOW 3.7

PyPI

CVE-2024-47869

CVE-2024-47869

Oct 10, 2024

HIGH 8.3

PyPI

CVE-2024-47084

CVE-2024-47084

Oct 10, 2024

MEDIUM 4.3

PyPI

CVE-2024-47168

CVE-2024-47168

Oct 10, 2024

MEDIUM 4.3

PyPI

GHSA-3x9g-xfj5-fq84

Duplicate Advisory: Cross-Site Request Forgery in Gradio

Mar 21, 2024

MEDIUM 5.3

PyPI

GHSA-26jh-r8g2-6fpr

Gradio's dropdown component pre-process step does not limit the values to those in the dropdown list

Oct 10, 2024

MEDIUM 6.5

PyPI

CVE-2024-34511

Gradio's Component Server does not properly consider` _is_server_fn` for functions

May 5, 2024

MEDIUM 6.5

PyPI

CVE-2024-48052

gradio Server Side Request Forgery vulnerability

Nov 5, 2024

MEDIUM 5.4

PyPI

CVE-2023-25823

Update share links to use FRP instead of SSH tunneling

Feb 23, 2023

MEDIUM 5.4

PyPI

CVE-2024-4940

Open redirect in gradio

Jun 22, 2024

HIGH 8.6

PyPI

CVE-2024-4325

Server-Side Request Forgery in gradio

Jun 6, 2024

MEDIUM 4.3

PyPI

CVE-2024-1727

Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading files

May 21, 2024

HIGH 7.5

PyPI

CVE-2024-1561

gradio vulnerable to Path Traversal

Apr 16, 2024

MEDIUM 6.5

PyPI

CVE-2024-1183

gradio Server-Side Request Forgery vulnerability

Apr 16, 2024

HIGH 8.6

PyPI

GHSA-xcgp-r7r8-2hc9

Gradio's CI vulnerable to Command Injection

Mar 27, 2024

HIGH 7.3

PyPI

CVE-2024-2206

gradio Server-Side Request Forgery vulnerability

Mar 27, 2024

MEDIUM 5.9

PyPI

CVE-2024-1729

Gradio apps vulnerable to timing attacks to guess password

Feb 22, 2024

CRITICAL 9.6

PyPI

CVE-2023-6572

Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Dec 14, 2023

HIGH 8.6

PyPI

CVE-2023-51449

Gradio makes the `/file` secure against file traversal and server-side request forgery attacks

Dec 21, 2023

MEDIUM 4.8

PyPI

CVE-2023-41626

Gradio arbitrary file upload vulnerability

Sep 16, 2023

HIGH 7.5

PyPI

CVE-2023-51449

CVE-2023-51449

Dec 22, 2023

UNKNOWN

PyPI

CVE-2023-34239

CVE-2023-34239

Jun 8, 2023

UNKNOWN

PyPI

CVE-2023-25823

CVE-2023-25823

Feb 23, 2023

UNKNOWN

PyPI

CVE-2022-24770

CVE-2022-24770

Mar 17, 2022

HIGH 8.8

PyPI

CVE-2022-24770

Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging

Mar 18, 2022

UNKNOWN

PyPI

CVE-2021-43831

CVE-2021-43831

Dec 15, 2021