CVE-2024-39236

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-07-01 · updated 2026-06-17
Weakness: CWE-94

Description

Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is triggered via a crafted input. NOTE: the supplier disputes this because the report is about a user attacking himself.

Affected products

gradio-app gradio: 4.36.1

References

https://github.com/Aaron911/PoC/blob/main/Gradio.md
https://github.com/advisories/GHSA-9v2f-6vcg-3hgv
https://github.com/gradio-app/gradio/issues/8853
https://github.com/Aaron911/PoC/blob/main/Gradio.md
https://github.com/advisories/GHSA-9v2f-6vcg-3hgv
https://github.com/gradio-app/gradio/issues/8853

Get alerted when CVE-2024-39236 or the next vulnerability affects your stack