Search for packages
| purl | pkg:pypi/gradio@4.37.2 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-8jw3-6x8j-v96g
Aliases: CVE-2025-48889 |
Gradio Allows Unauthorized File Copy via Path Manipulation An arbitrary file copy vulnerability in Gradio's flagging feature allows unauthenticated attackers … |
Vulnerable |
|
GHSA-j2jg-fq62-7c3h
Aliases: CVE-2025-23042 |
Gradio Blocked Path ACL Bypass Vulnerability ## Summary Gradio's Access Control List (ACL) for file paths can be bypassed by … |
Vulnerable |
|
GHSA-26jh-r8g2-6fpr
|
Gradio's dropdown component pre-process step does not limit the values to those in the dropdown list ### Impact **What kind … |
Vulnerable |
|
PYSEC-2024-214
Aliases: CVE-2024-47165 GHSA-89v2-pqfv-c5r9 |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **CORS origin validation accepting a null … |
Vulnerable |
|
PYSEC-2026-64
Aliases: CVE-2026-28414 GHSA-39mp-8hj3-5c49 |
Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with … |
Vulnerable |
|
PYSEC-2024-197
Aliases: CVE-2024-47166 GHSA-37qc-qgx6-9xjv |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **one-level read path traversal** in the … |
Vulnerable |
|
PYSEC-2026-66
Aliases: CVE-2026-28416 GHSA-jmh7-g254-2cq9 |
Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability … |
Vulnerable |
|
PYSEC-2024-217
Aliases: CVE-2024-47868 GHSA-4q3c-cj7g-jcwf |
Gradio is an open-source Python package designed for quick prototyping. This is a **data validation vulnerability** affecting several Gradio components, … |
Vulnerable |
|
PYSEC-2024-215
Aliases: CVE-2024-47167 GHSA-576c-3j53-r9jj |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **Server-Side Request Forgery (SSRF)** in the … |
Vulnerable |
|
PYSEC-2024-198
Aliases: CVE-2024-47168 GHSA-hm3c-93pg-4cxw |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enable_monitoring flag … |
Vulnerable |
|
PYSEC-2024-219
Aliases: CVE-2024-47871 GHSA-279j-x4gx-hfrh |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **insecure communication** between the FRP (Fast Reverse … |
Vulnerable |
|
PYSEC-2024-213
Aliases: CVE-2024-47164 GHSA-77xq-6g77-h274 |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the **bypass of directory traversal checks** … |
Vulnerable |
|
PYSEC-2024-199
Aliases: CVE-2024-47869 GHSA-j757-pf57-f8r4 |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio … |
Vulnerable |
|
PYSEC-2025-118
Aliases: CVE-2025-23042 GHSA-j2jg-fq62-7c3h |
Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, … |
Vulnerable |
|
PYSEC-2024-216
Aliases: CVE-2024-47867 GHSA-8c87-gvhj-xm8m |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a **lack of integrity check** on the … |
Vulnerable |
|
PYSEC-2024-196
Aliases: CVE-2024-47084 GHSA-3c67-5hwx-f6wx |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where the … |
Vulnerable |
|
PYSEC-2026-65
Aliases: CVE-2026-28415 GHSA-pfjf-5gxr-995x |
Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth … |
Vulnerable |
|
PYSEC-2026-63
Aliases: CVE-2026-27167 GHSA-h3h8-3v2v-rg7m |
Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio … |
Vulnerable |
|
PYSEC-2024-220
Aliases: CVE-2024-47872 GHSA-gvv6-33j7-884g |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **Cross-Site Scripting (XSS)** on any Gradio server … |
Vulnerable |
|
PYSEC-2024-218
Aliases: CVE-2024-47870 GHSA-xh2x-3mrm-fwqm |
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **race condition** in the `update_root_in_config` function, … |
Vulnerable |
|
GHSA-pgfv-gvc5-prfg
Aliases: CVE-2024-10648 |
Gradio Vulnerable to Arbitrary File Deletion A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of … | There are no reported fixed by versions. |
|
GHSA-7xmc-vhjp-qv5q
Aliases: CVE-2024-10569 |
Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb A vulnerability in the dataframe component of gradio-app/gradio (version … | There are no reported fixed by versions. |
|
GHSA-6655-8ph2-63j3
Aliases: CVE-2026-10783 |
Gradio: Audio cache key ignores metadata when saving numpy audio outputs A security flaw has been discovered in gradio-app gradio … |
Vulnerable |
|
PYSEC-2026-1412
Aliases: CVE-2024-10569 GHSA-7xmc-vhjp-qv5q |
Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb A vulnerability in the dataframe component of gradio-app/gradio (version … | There are no reported fixed by versions. |
|
PYSEC-2026-1410
Aliases: CVE-2024-8966 GHSA-5cpq-9538-jm2j |
Gradio DOS in multipart boundry while uploading the file A vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 … | There are no reported fixed by versions. |
|
PYSEC-2026-1417
Aliases: CVE-2024-10648 GHSA-pgfv-gvc5-prfg |
Gradio Vulnerable to Arbitrary File Deletion A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of … | There are no reported fixed by versions. |
|
PYSEC-2026-2178
Aliases: CVE-2026-48545 GHSA-7hp7-4p35-3cx2 |
Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting … |
Vulnerable |
|
PYSEC-2026-1408
Aliases: CVE-2024-48052 GHSA-3gf9-wv65-gwh9 |
gradio Server Side Request Forgery vulnerability In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. … | There are no reported fixed by versions. |
|
PYSEC-2026-1411
Aliases: CVE-2024-8021 GHSA-7v2w-h4gh-w5cv |
Gradio Vulnerable to Open Redirect An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an … | There are no reported fixed by versions. |
|
PYSEC-2026-211
Aliases: CVE-2026-10783 GHSA-6655-8ph2-63j3 |
A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache … | There are no reported fixed by versions. |
|
PYSEC-2026-1418
Aliases: CVE-2024-12217 GHSA-prpg-p95c-32fv |
Gradio Path Traversal vulnerability A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. … | There are no reported fixed by versions. |
|
PYSEC-2026-2179
Aliases: CVE-2026-49119 GHSA-j36p-7w88-g82j |
Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape … |
Not vulnerable Not vulnerable |