Gradio_project Gradio
50 CVEs affecting Gradio_project Gradio. Latest disclosed: 2026-07-01. Critical: 5, High: 23.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47167 | Critical | 9.8 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **Server-Side Request Forgery (SSRF)** in the `/queue/joi… |
CVE-2024-39236 | Critical | 9.8 | 2024-07-01 | Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is triggered via a craf… |
CVE-2024-0964 | Critical | 9.4 | 2024-02-05 | A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request. |
CVE-2024-47871 | Critical | 9.1 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **insecure communication** between the FRP (Fast Reverse Pr… |
CVE-2024-4253 | Critical | 9.1 | 2024-06-04 | A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises… |
CVE-2022-24770 | High | 8.8 | 2022-03-17 | `gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutra… |
CVE-2024-4325 | High | 8.6 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save… |
CVE-2024-47084 | High | 8.3 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where the Gradio server fa… |
CVE-2026-28416 | High | 8.2 | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio al… |
CVE-2024-10648 | High | 8.2 | 2025-03-20 | A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to c… |
CVE-2024-1540 | High | 8.2 | 2024-03-27 | A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special… |
CVE-2024-47870 | High | 8.1 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **race condition** in the `update_root_in_config` functio… |
CVE-2023-6572 | High | 8.1 | 2023-12-14 | Command Injection in GitHub repository gradio-app/gradio prior to main. |
CVE-2021-43831 | High | 7.7 | 2021-12-15 | Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects… |
CVE-2026-49119 | High | 7.5 | 2026-07-01 | Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape… |
CVE-2026-28414 | High | 7.5 | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to… |
CVE-2025-0187 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability was discovered in the file upload feature of gradio-app/gradio version 0.39.1. The vulnerability is due to improper han… |
CVE-2024-10624 | High | 7.5 | 2025-03-20 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected vers… |
CVE-2024-10569 | High | 7.5 | 2025-03-20 | A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process i… |
CVE-2025-23042 | High | 7.5 | 2025-01-14 | Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python funct… |