What is CVE-2024-47167?

CVE-2024-47167 is a critical-severity vulnerability in Gradio-App Gradio, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.8/10. Published 2024-10-10.

How severe is CVE-2024-47167?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2024-47167 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SSRF in Gradio-App Gradio

CVE-2024-47167

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **Server-Side Request Forgery (SSRF)** in the `/queue/join` endpoint. Gradio’s `async_save_url_to_cache` function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This could enable attackers to target internal servers or services within a local network and possibly exfiltrate data or cause unwanted internal requests. Additionally, the content from these URLs is stored locally, making it easier for attackers to upload potentially malicious files to the server. This impacts users deploying Gradio servers that use components like the Video component which involve URL fetching. Users are advised to upgrade to `gradio>=5` to address this issue. As a workaround, users can disable or heavily restrict URL-based inputs in their Gradio applications to trusted domains only. Additionally, implementing stricter URL validation (such as allowinglist-based validation) and ensuring that local or internal network addresses cannot be requested via the `/queue/join` endpoint can help mitigate the risk of SSRF attacks.

Vulnerability class: SSRF (Server-Side Request Forgery)

Published 2024-10-10 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.005 (38.7th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 38.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000

Affected products

Gradio-App Gradio — versions < 5.0
Gradio Project

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

Public proof-of-concept exploits

alexan011/CVE-2024-47167-Environment-Setup

References

github.com/gradio-app/gradio/security/advisories/GHSA-576c-3j53-r9jj (Third Party Advisory)

Frequently asked questions

What is CVE-2024-47167?: CVE-2024-47167 is a critical-severity vulnerability in Gradio-App Gradio, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.8/10. Published 2024-10-10.
How severe is CVE-2024-47167?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2024-47167 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.