What’s Vulnerable › Vulnerabilities

CVE-2024-0964: LFI in Gradio

• Severity: critical (CVSS 9.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-02-05 · updated 2026-06-17
• Weakness: CWE-22

Description

A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.

Affected products

• gradio-app gradio: all versions

References

• https://github.com/gradio-app/gradio/commit/d76bcaaaf0734aaf49a680f94ea9d4d22a602e70
• https://huntr.com/bounties/25e25501-5918-429c-8541-88832dfd3741
• https://github.com/gradio-app/gradio/commit/d76bcaaaf0734aaf49a680f94ea9d4d22a602e70
• https://huntr.com/bounties/25e25501-5918-429c-8541-88832dfd3741

Get alerted when CVE-2024-0964 or the next vulnerability affects your stack