Search for packages
| purl | pkg:pypi/gradio@2.0.9 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-8jw3-6x8j-v96g
Aliases: CVE-2025-48889 |
Gradio Allows Unauthorized File Copy via Path Manipulation An arbitrary file copy vulnerability in Gradio's flagging feature allows unauthenticated attackers … |
Vulnerable |
|
GHSA-j2jg-fq62-7c3h
Aliases: CVE-2025-23042 |
Gradio Blocked Path ACL Bypass Vulnerability ## Summary Gradio's Access Control List (ACL) for file paths can be bypassed by … |
Vulnerable |
|
GHSA-26jh-r8g2-6fpr
|
Gradio's dropdown component pre-process step does not limit the values to those in the dropdown list ### Impact **What kind … |
Vulnerable |
|
GHSA-6qm2-wpxq-7qh2
Aliases: CVE-2023-51449 |
Gradio makes the `/file` secure against file traversal and server-side request forgery attacks Older versions of `gradio` contained a vulnerability … |
Vulnerable |
|
PYSEC-2024-214
Aliases: CVE-2024-47165 GHSA-89v2-pqfv-c5r9 |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **CORS origin validation accepting a null … |
Vulnerable |
|
PYSEC-2022-229
Aliases: CVE-2022-24770 GHSA-f8xq-q7px-wg8c |
`gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers … |
Vulnerable |
|
PYSEC-2026-64
Aliases: CVE-2026-28414 GHSA-39mp-8hj3-5c49 |
Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with … |
Vulnerable |
|
PYSEC-2024-274
Aliases: CVE-2024-39236 GHSA-9v2f-6vcg-3hgv |
Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is triggered via a … | There are no reported fixed by versions. |
|
PYSEC-2024-197
Aliases: CVE-2024-47166 GHSA-37qc-qgx6-9xjv |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **one-level read path traversal** in the … |
Vulnerable |
|
PYSEC-2026-66
Aliases: CVE-2026-28416 GHSA-jmh7-g254-2cq9 |
Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability … |
Vulnerable |
|
PYSEC-2024-217
Aliases: CVE-2024-47868 GHSA-4q3c-cj7g-jcwf |
Gradio is an open-source Python package designed for quick prototyping. This is a **data validation vulnerability** affecting several Gradio components, … |
Vulnerable |
|
PYSEC-2023-249
Aliases: CVE-2023-51449 GHSA-6qm2-wpxq-7qh2 |
Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine … |
Vulnerable |
|
PYSEC-2024-215
Aliases: CVE-2024-47167 GHSA-576c-3j53-r9jj |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **Server-Side Request Forgery (SSRF)** in the … |
Vulnerable |
|
PYSEC-2024-198
Aliases: CVE-2024-47168 GHSA-hm3c-93pg-4cxw |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enable_monitoring flag … |
Vulnerable |
|
PYSEC-2024-219
Aliases: CVE-2024-47871 GHSA-279j-x4gx-hfrh |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **insecure communication** between the FRP (Fast Reverse … |
Vulnerable |
|
PYSEC-2024-213
Aliases: CVE-2024-47164 GHSA-77xq-6g77-h274 |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the **bypass of directory traversal checks** … |
Vulnerable |
|
PYSEC-2023-255
Aliases: CVE-2023-6572 GHSA-gqvf-3hgp-5hxv |
Command Injection in GitHub repository gradio-app/gradio prior to main. |
Vulnerable |
|
PYSEC-2024-199
Aliases: CVE-2024-47869 GHSA-j757-pf57-f8r4 |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio … |
Vulnerable |
|
PYSEC-2025-118
Aliases: CVE-2025-23042 GHSA-j2jg-fq62-7c3h |
Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, … |
Vulnerable |
|
PYSEC-2024-216
Aliases: CVE-2024-47867 GHSA-8c87-gvhj-xm8m |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a **lack of integrity check** on the … |
Vulnerable |
|
PYSEC-2024-184
Aliases: CVE-2024-4941 GHSA-6v6g-j5fq-hpvw |
A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input … |
Vulnerable |
|
PYSEC-2024-255
Aliases: CVE-2024-34510 GHSA-rvfh-h6c7-fc3c |
Gradio before 4.20 allows credential leakage on Windows. |
Vulnerable |
|
PYSEC-2024-196
Aliases: CVE-2024-47084 GHSA-3c67-5hwx-f6wx |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where the … |
Vulnerable |
|
PYSEC-2026-65
Aliases: CVE-2026-28415 GHSA-pfjf-5gxr-995x |
Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth … |
Vulnerable |
|
PYSEC-2023-16
Aliases: CVE-2023-25823 GHSA-3x5j-9vwr-8rr5 |
Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to … |
Vulnerable |
|
PYSEC-2024-220
Aliases: CVE-2024-47872 GHSA-gvv6-33j7-884g |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **Cross-Site Scripting (XSS)** on any Gradio server … |
Vulnerable |
|
PYSEC-2023-90
Aliases: CVE-2023-34239 GHSA-3qqg-pgqq-3695 |
Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack … |
Vulnerable |
|
PYSEC-2024-218
Aliases: CVE-2024-47870 GHSA-xh2x-3mrm-fwqm |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **race condition** in the `update_root_in_config` function, … |
Vulnerable |
|
PYSEC-2021-873
Aliases: CVE-2021-43831 GHSA-rhq2-3vr9-6mcr |
Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there … |
Vulnerable |
|
PYSEC-2023-255
Aliases: CVE-2023-6572 GHSA-gqvf-3hgp-5hxv |
Command Injection in GitHub repository gradio-app/gradio prior to main. |
Vulnerable |
|
PYSEC-2024-184
Aliases: CVE-2024-4941 GHSA-6v6g-j5fq-hpvw |
A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input … |
Vulnerable |
|
PYSEC-2026-345
Aliases: CVE-2024-1728 GHSA-m842-4qm8-7gpq |
Gradio allows users to access arbitrary files ### Impact This vulnerability allows users of Gradio applications that have a public … |
Vulnerable |
|
GHSA-3f95-mxq2-2f63
|
Duplicate Advisory: Gradio Local File Inclusion vulnerability ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate … |
Vulnerable Vulnerable |
|
GHSA-f3h9-8phc-6gvh
Aliases: CVE-2024-0964 |
Gradio Path Traversal vulnerability A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON … |
Vulnerable Vulnerable |
|
GHSA-6v6g-j5fq-hpvw
Aliases: CVE-2024-4941 |
Local file inclusion in gradio A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio and was discovered … |
Vulnerable Vulnerable |
|
GHSA-xcgp-r7r8-2hc9
Aliases: CVE-2024-1540 |
Gradio's CI vulnerable to Command Injection A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due … |
Vulnerable Vulnerable |
|
GHSA-gqvf-3hgp-5hxv
Aliases: CVE-2023-6572 |
Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability Exposure of Sensitive Information to an Unauthorized Actor in GitHub … |
Vulnerable Vulnerable |
|
GHSA-6655-8ph2-63j3
Aliases: CVE-2026-10783 |
Gradio: Audio cache key ignores metadata when saving numpy audio outputs A security flaw has been discovered in gradio-app gradio … |
Vulnerable |
|
PYSEC-2026-1413
Aliases: CVE-2024-4325 GHSA-973g-55hp-3frw |
Server-Side Request Forgery in gradio A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio and was discovered in version … | There are no reported fixed by versions. |
|
PYSEC-2026-1420
Aliases: CVE-2024-2206 GHSA-r364-m2j9-mf4h |
gradio Server-Side Request Forgery vulnerability An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in … |
Vulnerable |
|
PYSEC-2026-1407
Aliases: CVE-2024-34511 GHSA-34rf-p3r3-58x2 |
Gradio's Component Server does not properly consider` _is_server_fn` for functions Component Server in Gradio before 4.13 does not properly consider` … |
Vulnerable |
|
PYSEC-2026-1415
Aliases: CVE-2024-1561 GHSA-g9cj-cfpp-4g2x |
gradio vulnerable to Path Traversal An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of … |
Vulnerable |
|
PYSEC-2026-1409
Aliases: CVE-2024-1727 GHSA-3x9g-xfj5-fq84 GHSA-48cq-79qq-6f7x |
Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading files ### Impact This CVE covers the … |
Vulnerable |
|
PYSEC-2026-1422
Aliases: CVE-2023-41626 GHSA-v4q9-qgqf-7jwp |
Gradio arbitrary file upload vulnerability Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the `/upload` interface. | There are no reported fixed by versions. |
|
PYSEC-2026-1414
Aliases: CVE-2024-4940 GHSA-g6c9-f4xm-9j4x |
Open redirect in gradio An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an … | There are no reported fixed by versions. |
|
PYSEC-2026-1416
Aliases: CVE-2024-1729 GHSA-hmx6-r76c-85g9 |
Gradio apps vulnerable to timing attacks to guess password ### Impact This security policy is with regards to a timing … |
Vulnerable |
|
PYSEC-2026-1410
Aliases: CVE-2024-8966 GHSA-5cpq-9538-jm2j |
Gradio DOS in multipart boundry while uploading the file A vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 … | There are no reported fixed by versions. |
|
PYSEC-2026-1419
Aliases: CVE-2024-1183 GHSA-qh6x-j82h-vpf9 |
gradio Server-Side Request Forgery vulnerability An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan … |
Vulnerable |
|
PYSEC-2026-2178
Aliases: CVE-2026-48545 GHSA-7hp7-4p35-3cx2 |
Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting … |
Vulnerable |
|
PYSEC-2026-1408
Aliases: CVE-2024-48052 GHSA-3gf9-wv65-gwh9 |
gradio Server Side Request Forgery vulnerability In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. … | There are no reported fixed by versions. |
|
PYSEC-2026-1411
Aliases: CVE-2024-8021 GHSA-7v2w-h4gh-w5cv |
Gradio Vulnerable to Open Redirect An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an … | There are no reported fixed by versions. |
|
PYSEC-2024-321
Aliases: CVE-2024-4253 |
A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper … |
Vulnerable |
|
PYSEC-2026-211
Aliases: CVE-2026-10783 GHSA-6655-8ph2-63j3 |
A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache … | There are no reported fixed by versions. |
|
PYSEC-2026-1418
Aliases: CVE-2024-12217 GHSA-prpg-p95c-32fv |
Gradio Path Traversal vulnerability A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. … | There are no reported fixed by versions. |
|
PYSEC-2026-2179
Aliases: CVE-2026-49119 GHSA-j36p-7w88-g82j |
Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape … |
Not vulnerable Not vulnerable |