What’s Vulnerable › Products

gradio-app gradio vulnerabilities

53 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.

Check whether your gradio-app gradio version is affected

Latest gradio-app gradio vulnerabilities

• CVE-2026-59806 — Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint (CVSS 7.4)
• CVE-2026-49119 — Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess() (CVSS 7.5)
• CVE-2026-10783 — gradio-app gradio Audio Cache Key save_audio_to_cache weak hash (CVSS 2.5)
• CVE-2026-48545 — Gradio < 6.15.0 Cookie Injection via Shared Proxy Client (CVSS 6.8)
• CVE-2026-28416 — Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing (CVSS 8.6)
• CVE-2026-28415 — Gradio has Open Redirect in OAuth Flow (CVSS 4.7)
• CVE-2026-28414 — Gradio has Absolute Path Traversal on Windows with Python 3.13+ (CVSS 7.5)
• CVE-2026-27167 — Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret (CVSS 5.9)
• CVE-2025-48889 — Gradio Allows Unauthorized File Copy via Path Manipulation (CVSS 7.5)
• CVE-2025-5320 — gradio-app gradio CORS is_valid_origin privilege escalation (CVSS 3.7)
• CVE-2025-0187 — Denial of Service (DoS) by Sending Large Filename at File Upload Endpoint in gradio-app/gradio (CVSS 7.5)
• CVE-2024-8021 — Open Redirect in gradio-app/gradio (CVSS 6.1)
• CVE-2024-12217 — Path Traversal in gradio-app/gradio (CVSS 5.3)
• CVE-2024-10648 — Path Traversal in gradio-app/gradio (CVSS 8.2)
• CVE-2024-10624 — Regular Expression Denial of Service (ReDoS) in gradio-app/gradio (CVSS 7.5)
• CVE-2024-10569 — Zip Bomb Vulnerability in gradio-app/gradio (CVSS 7.5)
• CVE-2025-23042 — Gradio Blocked Path ACL Bypass Vulnerability (CVSS 7.5)
• CVE-2024-51751 — Arbitrary file read with File and UploadButton components in Gradio (CVSS 6.5)
• CVE-2024-48052 — (CVSS 6.5)
• CVE-2024-47872 — Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files (CVSS 5.4)
• CVE-2024-47871 — Insecure communication between the FRP client and server in Gradio (CVSS 9.1)
• CVE-2024-47870 — Race condition in update_root_in_config may redirect user traffic in Gradio (CVSS 8.1)
• CVE-2024-47869 — Non-constant-time comparison when comparing hashes in Gradio (CVSS 3.7)
• CVE-2024-47868 — Several components’ post-process steps may allow arbitrary file leaks in Gradio (CVSS 7.5)
• CVE-2024-47867 — Lack of integrity check on the downloaded FRP client in Gradio (CVSS 7.5)