CVE-2026-59806 | High | 7.4 | 2026-07-08 | Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URLs or perfo… |
CVE-2026-49119 | High | 7.5 | 2026-07-01 | Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape… |
CVE-2026-10783 | Low | 2.5 | 2026-06-04 | A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Perfor… |
CVE-2026-48545 | Medium | 6.8 | 2026-05-27 | Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a sha… |
CVE-2026-28416 | High | 8.2 | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio al… |
CVE-2026-28415 | Medium | 4.3 | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accep… |
CVE-2026-28414 | High | 7.5 | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to… |
CVE-2026-27167 | Unrated | | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outs… |
CVE-2025-48889 | Medium | 5.3 | 2025-05-30 | Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python funct… |
CVE-2025-5320 | Low | 3.7 | 2025-05-29 | A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function is_valid_origin of the component CORS Han… |
CVE-2025-0187 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability was discovered in the file upload feature of gradio-app/gradio version 0.39.1. The vulnerability is due to improper han… |
CVE-2024-8966 | High | 7.5 | 2025-03-20 | A vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 allows for a Denial of Service (DoS) attack. An attacker can appen… |
CVE-2024-8021 | Medium | 6.1 | 2025-03-20 | An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an attacker to redirect users to a malicious website… |
CVE-2024-12217 | Medium | 5.3 | 2025-03-20 | A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path funct… |
CVE-2024-10648 | High | 8.2 | 2025-03-20 | A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to c… |
CVE-2024-10624 | High | 7.5 | 2025-03-20 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected vers… |
CVE-2024-10569 | High | 7.5 | 2025-03-20 | A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process i… |
CVE-2025-23042 | High | 7.5 | 2025-01-14 | Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python funct… |
CVE-2024-51751 | Medium | 6.5 | 2024-11-06 | Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of… |
CVE-2024-47872 | Medium | 5.4 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **Cross-Site Scripting (XSS)** on any Gradio server that al… |
CVE-2024-47871 | Critical | 9.1 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **insecure communication** between the FRP (Fast Reverse Pr… |
CVE-2024-47870 | High | 8.1 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **race condition** in the `update_root_in_config` functio… |
CVE-2024-47869 | Low | 3.7 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for t… |
CVE-2024-47868 | High | 7.5 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This is a **data validation vulnerability** affecting several Gradio components, which… |
CVE-2024-47867 | High | 7.5 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a **lack of integrity check** on the downloaded FRP client, which… |
CVE-2024-47168 | Medium | 4.3 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enable_monitoring flag not properl… |
CVE-2024-47167 | Critical | 9.8 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **Server-Side Request Forgery (SSRF)** in the `/queue/joi… |
CVE-2024-47166 | Medium | 5.3 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **one-level read path traversal** in the `/custom_compone… |
CVE-2024-47165 | Medium | 5.4 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **CORS origin validation accepting a null origin**. When… |
CVE-2024-47164 | Medium | 6.5 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the **bypass of directory traversal checks** within the `… |
CVE-2024-47084 | High | 8.3 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where the Gradio server fa… |
CVE-2024-4940 | Medium | 6.1 | 2024-06-22 | An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitra… |
CVE-2024-4941 | High | 7.5 | 2024-06-06 | A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in… |
CVE-2024-4325 | High | 8.6 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save… |
CVE-2024-4254 | High | 7.1 | 2024-06-04 | The 'deploy-website.yml' workflow in the gradio-app/gradio repository, specifically in the 'main' branch, is vulnerable to secrets exfiltration due to improper… |
CVE-2024-4253 | Critical | 9.1 | 2024-06-04 | A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises… |
CVE-2024-1561 | High | 7.5 | 2024-04-16 | An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of any method on a `Component` class with… |
CVE-2024-1183 | Medium | 6.5 | 2024-04-16 | An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an in… |
CVE-2024-1728 | High | 7.5 | 2024-04-10 | gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attack… |
CVE-2024-1729 | Medium | 5.9 | 2024-03-29 | A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from th… |
CVE-2024-1540 | High | 8.2 | 2024-03-27 | A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special… |
CVE-2024-2206 | Medium | 6.5 | 2024-03-27 | An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the `/proxy` route. Attackers can exploit this vu… |
CVE-2024-1727 | Medium | 4.3 | 2024-03-21 | A Cross-Site Request Forgery (CSRF) vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running… |
CVE-2024-0964 | Critical | 9.4 | 2024-02-05 | A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request. |
CVE-2023-51449 | Medium | 5.6 | 2023-12-22 | Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python… |
CVE-2023-6572 | High | 8.1 | 2023-12-14 | Command Injection in GitHub repository gradio-app/gradio prior to main. |
CVE-2023-34239 | High | 7.3 | 2023-06-08 | Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restr… |
CVE-2023-25823 | Medium | 5.4 | 2023-02-23 | Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-cod… |
CVE-2022-24770 | High | 8.8 | 2022-03-17 | `gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutra… |
CVE-2021-43831 | High | 7.7 | 2021-12-15 | Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects… |