What’s Vulnerable › Vulnerabilities
CVE-2024-47084: CORS origin validation is not performed when the request has a cookie in Gradio
- Severity: high (CVSS 8.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-10-10 · updated 2026-06-17
- Weakness: CWE-285
Description
Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio server. Potentially, attackers can upload files, steal authentication tokens, and access user data if the victim visits a malicious website while logged into Gradio. This impacts users who have deployed Gradio locally and use basic authentication. Users are advised to upgrade to `gradio>4.44` to address this issue. As a workaround, users can manually enforce stricter CORS origin validation by modifying the `CustomCORSMiddleware` class in their local Gradio server code. Specifically, they can bypass the condition that skips CORS validation for requests containing cookies to prevent potential exploitation.
Affected products
- gradio-app gradio: before 4.44.0 — fixed in 4.44.0
How to fix
Upgrade to a fixed version: gradio-app gradio 4.44.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-47084 or the next vulnerability affects your stack