VulnerableCode Package Details - pkg:pypi/gradio@5.50.1.dev0

Search for packages

Vulnerability	Summary	Fixed by
VCID-bmqt-uegd-hyap Aliases: CVE-2026-28416 GHSA-jmh7-g254-2cq9 PYSEC-2026-66	Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victim application uses `gr.load()` to load an attacker-controlled Space, the malicious `proxy_url` from the config is trusted and added to the allowlist, enabling the attacker to access internal services, cloud metadata endpoints, and private networks through the victim's infrastructure. Version 6.6.0 fixes the issue.	6.6.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-dsw8-wy3z-53hm Aliases: CVE-2026-28414 GHSA-39mp-8hj3-5c49 PYSEC-2026-64	Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitrary files from the file system. Python 3.13+ changed the definition of `os.path.isabs` so that root-relative paths like `/windows/win.ini` on Windows are no longer considered absolute paths, resulting in a vulnerability in Gradio's logic for joining paths safely. This can be exploited by unauthenticated attackers to read arbitrary files from the Gradio server, even when Gradio is set up with authentication. Version 6.7 fixes the issue.	6.7.0 Affected by 0 other vulnerabilities.
VCID-j1w9-nvdf-nfbr Aliases: CVE-2026-28415 GHSA-pfjf-5gxr-995x PYSEC-2026-65	Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback endpoints on Gradio apps with OAuth enabled (i.e. apps running on Hugging Face Spaces with gr.LoginButton). Starting in version 6.6.0, the _target_url parameter is sanitized to only use the path, query, and fragment, stripping any scheme or host.	6.6.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-vaq5-ccvf-kyg6 Aliases: CVE-2026-27167 GHSA-h3h8-3v2v-rg7m PYSEC-2026-63	Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable "mocked" OAuth routes when OAuth components (e.g. `gr.LoginButton`) are used. When a user visits `/login/huggingface`, the server retrieves its own Hugging Face access token via `huggingface_hub.get_token()` and stores it in the visitor's session cookie. If the application is network-accessible, any remote attacker can trigger this flow to steal the server owner's HF token. The session cookie is signed with a hardcoded secret derived from the string `"-v4"`, making the payload trivially decodable. Version 6.6.0 fixes the issue.	6.6.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-bmqt-uegd-hyap
Aliases:
CVE-2026-28416
GHSA-jmh7-g254-2cq9
PYSEC-2026-66

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victim application uses `gr.load()` to load an attacker-controlled Space, the malicious `proxy_url` from the config is trusted and added to the allowlist, enabling the attacker to access internal services, cloud metadata endpoints, and private networks through the victim's infrastructure. Version 6.6.0 fixes the issue.

6.6.0
Affected by 1 other vulnerability.

VCID-dsw8-wy3z-53hm
Aliases:
CVE-2026-28414
GHSA-39mp-8hj3-5c49
PYSEC-2026-64

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitrary files from the file system. Python 3.13+ changed the definition of `os.path.isabs` so that root-relative paths like `/windows/win.ini` on Windows are no longer considered absolute paths, resulting in a vulnerability in Gradio's logic for joining paths safely. This can be exploited by unauthenticated attackers to read arbitrary files from the Gradio server, even when Gradio is set up with authentication. Version 6.7 fixes the issue.

6.7.0
Affected by 0 other vulnerabilities.

VCID-j1w9-nvdf-nfbr
Aliases:
CVE-2026-28415
GHSA-pfjf-5gxr-995x
PYSEC-2026-65

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback endpoints on Gradio apps with OAuth enabled (i.e. apps running on Hugging Face Spaces with gr.LoginButton). Starting in version 6.6.0, the _target_url parameter is sanitized to only use the path, query, and fragment, stripping any scheme or host.

6.6.0
Affected by 1 other vulnerability.

VCID-vaq5-ccvf-kyg6
Aliases:
CVE-2026-27167
GHSA-h3h8-3v2v-rg7m
PYSEC-2026-63

Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable "mocked" OAuth routes when OAuth components (e.g. `gr.LoginButton`) are used. When a user visits `/login/huggingface`, the server retrieves its own Hugging Face access token via `huggingface_hub.get_token()` and stores it in the visitor's session cookie. If the application is network-accessible, any remote attacker can trigger this flow to steal the server owner's HF token. The session cookie is signed with a hardcoded secret derived from the string `"-v4"`, making the payload trivially decodable. Version 6.6.0 fixes the issue.

6.6.0
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-02T04:24:10.023567+00:00	Pypa Importer	Affected by	VCID-bmqt-uegd-hyap	https://github.com/pypa/advisory-database/blob/main/vulns/gradio/PYSEC-2026-66.yaml	38.6.0
2026-06-02T04:24:07.166258+00:00	Pypa Importer	Affected by	VCID-j1w9-nvdf-nfbr	https://github.com/pypa/advisory-database/blob/main/vulns/gradio/PYSEC-2026-65.yaml	38.6.0
2026-06-02T04:24:04.344333+00:00	Pypa Importer	Affected by	VCID-dsw8-wy3z-53hm	https://github.com/pypa/advisory-database/blob/main/vulns/gradio/PYSEC-2026-64.yaml	38.6.0
2026-06-02T04:24:01.569576+00:00	Pypa Importer	Affected by	VCID-vaq5-ccvf-kyg6	https://github.com/pypa/advisory-database/blob/main/vulns/gradio/PYSEC-2026-63.yaml	38.6.0