Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
40 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape the configured root directory by supplying path segments containing directory traversal sequences or absolute paths. Attackers can provide crafted path segments that cause os.path.join to discard the rootdir prefix entirely, resulting in arbitrary file read or exposure of sensitive files outside the intended directory.
Recommended action: Upgrade to 6.16.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function saveaudiotocache of the component Audio Cache Key Handler. Performing a manipulation results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The patch is named 13394. To fix this issue, it is recommended to deploy a patch.
Recommended action: Upgrade to 6.15.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across all users in the reverse proxy endpoint. Attackers controlling any HF Space can return a parent-domain cookie that the shared client stores and automatically replays into all subsequent proxy requests to other legitimate Spaces, affecting all users of the same Gradio deployment.
Recommended action: Upgrade to 6.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victim application uses gr.load() to load an attacker-controlled Space, the malicious proxyurl from the config is trusted and added to the allowlist, enabling the attacker to access internal services, cloud metadata endpoints, and private networks through the victim's infrastructure. Details The vulnerability exists in Gradio's config processing flow when loading external Spaces: 1. Config Fetching (gradio/external.py:630): gr.load() calls Blocks.fromconfig() which fetches and processes the remote Space's configuration. 2. Proxy URL Trust (gradio/blocks.py:1231-1233): The proxyurl from the untrusted config is added directly to self.proxyurls: 3. Built-in Proxy Route (gradio/routes.py:1029-1031): Every Gradio app automatically exposes a /proxy={urlpath} endpoint: 4. Host-based Validation…
Recommended action: Upgrade to 6.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The redirecttotarget() function in Gradio's OAuth flow accepts an unvalidated targeturl query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback endpoints on Gradio apps with OAuth enabled (i.e. apps running on Hugging Face Spaces with gr.LoginButton). Details An attacker can craft a URL like https://my-space.hf.space/logout?targeturl=https://evil.com/phishing that redirects the user to an external site after logout. Because the URL originates from a trusted hf.space domain, users are more likely to trust the link. Impact Phishing — an attacker can use the trusted domain to redirect users to a malicious site. No direct data exposure or server-side impact. Fix The targeturl parameter is now sanitized to only use the path, query, and fragment, stripping any scheme or host.
Recommended action: Upgrade to 6.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitrary files from the file system. Details Python 3.13+ changed the definition of os.path.isabs so that root-relative paths like /windows/win.ini on Windows are no longer considered absolute paths, resulting in a vulnerability in Gradio's logic for joining paths safely. This can be exploited by unauthenticated attackers to read arbitrary files from the Gradio server, even when Gradio is set up with authentication. PoC Impact Arbitrary file read in the context of the Windows user running Gradio.
Recommended action: Upgrade to 6.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Gradio applications running outside of Hugging Face Spaces automatically enable "mocked" OAuth routes when OAuth components (e.g. gr.LoginButton) are used. When a user visits /login/huggingface, the server retrieves its own Hugging Face access token via huggingfacehub.gettoken() and stores it in the visitor's session cookie. If the application is network-accessible, any remote attacker can trigger this flow to steal the server owner's HF token. The session cookie is signed with a hardcoded secret derived from the string "-v4", making the payload trivially decodable. Affected Component gradio/oauth.py — functions attachoauth(), addmockedoauthroutes(), and getmockedoauthinfo(). Root Cause Analysis 1. Real token injected into every visitor's session When Gradio detects it is not running inside a Hugging Face Space (getspace() is None), it registers mocked OAuth routes via addmockedoauthroutes() (line 44). The function getmockedoauthinfo() (line 307) calls…
Recommended action: Upgrade to 6.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An arbitrary file copy vulnerability in Gradio's flagging feature allows unauthenticated attackers to copy any readable file from the server's filesystem. While attackers can't read these copied files, they can cause DoS by copying large files (like /dev/urandom) to fill disk space. Description The flagging component doesn't properly validate file paths before copying files. Attackers can send specially crafted requests to the /gradioapi/run/predict endpoint to trigger these file copies. Source: User-controlled path parameter in the flagging functionality JSON payload Sink: shutil.copy operation in FileData.copytodir() method The vulnerable code flow: 1. A JSON payload is sent to the /gradioapi/run/predict endpoint 2. The path field within FileData object can reference any file on the system 3. When processing this request, the Component.flag() method creates a GradioDataModel object 4. The FileData.copytodir() method uses this path without proper validation: 5. The lack of…
Recommended action: Upgrade to 5.31.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Gradio's Access Control List (ACL) for file paths can be bypassed by altering the letter case of a blocked file or directory path. This vulnerability arises due to the lack of case normalization in the file path validation logic. On case-insensitive file systems, such as those used by Windows and macOS, this flaw enables attackers to circumvent security restrictions and access sensitive files that should be protected. This issue can lead to unauthorized data access, exposing sensitive information and undermining the integrity of Gradio's security model. Given Gradio's popularity for building web applications, particularly in machine learning and AI, this vulnerability may pose a substantial threat if exploited in production environments. Affected Version Gradio <= 5.6.0 Impact - Unauthorized Access: Sensitive files or directories specified in blockedpaths can be accessed by attackers. - Data Exposure: Critical files, such as configuration files or user data, may be leaked. -…
Recommended action: Upgrade to 5.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary files from the application server. Details Consider the following application where a user can upload a file and preview its content: If we run this application and make the following request (which attempts to read the /etc/passwd file) Then this results in the following error on the server This is expected. However, if we now remove the "meta":{"type":"gradio.FileData"} from the request: This doesn't cause an error and results in the content of /etc/passwd being shown in the response! This works because Gradio relies on the processingutils.asyncmovefilestocache to sanitize all incoming file paths in all inputs. This function performs the following operation where clientutils.isfileobjwithmeta is used as a filter which tells on which inputs to perform the movetocache function (which also…
Recommended action: Upgrade to 5.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? This vulnerability is a data validation issue in the Gradio Dropdown component's pre-processing step. Even if the allowcustomvalue parameter is set to False, attackers can bypass this restriction by sending custom requests with arbitrary values, effectively breaking the developer’s intended input constraints. While this alone is not a severe vulnerability, it can lead to more critical security issues, particularly when paired with other vulnerabilities like file downloads from the user's machine. Patches Yes, this issue is addressed in gradio=5.0. Please upgrade to the latest version to resolve the problem. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? To mitigate the issue without upgrading, developers can add manual validation in their prediction function to check the received values against the allowed dropdown values before processing them.
Recommended action: Upgrade to 5.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves Cross-Site Scripting (XSS) on any Gradio server that allows file uploads. Authenticated users can upload files such as HTML, JavaScript, or SVG files containing malicious scripts. When other users download or view these files, the scripts will execute in their browser, allowing attackers to perform unauthorized actions or steal sensitive information from their sessions. This impacts any Gradio server that allows file uploads, particularly those using components that process or display user-uploaded files. Patches Yes, please upgrade to gradio=5 to address this issue. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? As a workaround, users can restrict the types of files that can be uploaded to the Gradio server by limiting uploads to non-executable file types such as images or text. Additionally, developers can implement server-side validation to sanitize…
Recommended action: Upgrade to 5.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves insecure communication between the FRP (Fast Reverse Proxy) client and server when Gradio's share=True option is used. HTTPS is not enforced on the connection, allowing attackers to intercept and read files uploaded to the Gradio server, as well as modify responses or data sent between the client and server. This impacts users who are sharing Gradio demos publicly over the internet using share=True without proper encryption, exposing sensitive data to potential eavesdroppers. Patches Yes, please upgrade to gradio=5 to address this issue. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? As a workaround, users can avoid using share=True in production environments and instead host their Gradio applications on servers with HTTPS enabled to ensure secure communication.
Recommended action: Upgrade to 5.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves a race condition in the updaterootinconfig function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition. Patches Yes, please upgrade to gradio=5 to address this issue.
Recommended action: Upgrade to 5.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash byte-by-byte. This can lead to unauthorized access to the analytics dashboard, especially if the attacker can repeatedly query the system with different keys. Patches Yes, please upgrade to gradio4.44 to mitigate this issue. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? To mitigate the risk before applying the patch, developers can manually patch the analyticsdashboard dashboard to use a constant-time comparison function for comparing sensitive values, such as hashes. Alternatively, access to the analytics dashboard can be disabled.
Recommended action: Upgrade to 4.44.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? This is a data validation vulnerability affecting several Gradio components, which allows arbitrary file leaks through the post-processing step. Attackers can exploit these components by crafting requests that bypass expected input constraints. This issue could lead to sensitive files being exposed to unauthorized users, especially when combined with other vulnerabilities, such as issue TOB-GRADIO-15. The components most at risk are those that return or handle file data. Vulnerable Components: 1. String to FileData: DownloadButton, Audio, ImageEditor, Video, Model3D, File, UploadButton. 2. Complex data to FileData: Chatbot, MultimodalTextbox. 3. Direct file read in preprocess: Code. 4. Dictionary converted to FileData: ParamViewer, Dataset. Exploit Scenarios: 1. A developer creates a Dropdown list that passes values to a DownloadButton. An attacker bypasses the allowed inputs, sends an arbitrary file path (like /etc/passwd),…
Recommended action: Upgrade to 5.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This vulnerability is a lack of integrity check on the downloaded FRP client, which could potentially allow attackers to introduce malicious code. If an attacker gains access to the remote URL from which the FRP client is downloaded, they could modify the binary without detection, as the Gradio server does not verify the file's checksum or signature. Who is impacted? Any users utilizing the Gradio server's sharing mechanism that downloads the FRP client could be affected by this vulnerability, especially those relying on the executable binary for secure data tunneling. Patches Yes, please upgrade to gradio=5.0, which includes a fix to verify the integrity of the downloaded binary. Workarounds There is no direct workaround for this issue without upgrading. However, users can manually validate the integrity of the downloaded FRP client by implementing checksum or signature verification in their own environment to ensure the binary hasn't been tampered with.
Recommended action: Upgrade to 5.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves data exposure due to the enablemonitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access the monitoring dashboard by directly requesting the /monitoring endpoint. This means that sensitive application analytics may still be exposed, particularly in environments where monitoring is expected to be disabled. Users who set enablemonitoring=False to prevent unauthorized access to monitoring data are impacted. Patches Yes, please upgrade to gradio=4.44 to address this issue.
Recommended action: Upgrade to 4.44.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? This vulnerability relates to Server-Side Request Forgery (SSRF) in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This could enable attackers to target internal servers or services within a local network and possibly exfiltrate data or cause unwanted internal requests. Additionally, the content from these URLs is stored locally, making it easier for attackers to upload potentially malicious files to the server. This impacts users deploying Gradio servers that use components like the Video component which involve URL fetching. Patches Yes, please upgrade to gradio=5 to address this issue. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? As a workaround, users can disable or heavily restrict URL-based inputs in their Gradio applications to trusted domains only. Additionally,…
Recommended action: Upgrade to 5.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves a one-level read path traversal in the /customcomponent endpoint. Attackers can exploit this flaw to access and leak source code from custom Gradio components by manipulating the file path in the request. Although the traversal is limited to a single directory level, it could expose proprietary or sensitive code that developers intended to keep private. This impacts users who have developed custom Gradio components and are hosting them on publicly accessible servers. Patches Yes, please upgrade to gradio=4.44 to address this issue. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? As a workaround, developers can sanitize the file paths and ensure that components are not stored in publicly accessible directories.
Recommended action: Upgrade to 4.44.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhostaliases variable includes "null" as a valid origin. This allows attackers to make unauthorized requests from sandboxed iframes or other sources with a null origin, potentially leading to data theft, such as user authentication tokens or uploaded files. This impacts users running Gradio locally, especially those using basic authentication. Patches Yes, please upgrade to gradio=5.0 to address this issue. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? As a workaround, users can manually modify the localhostaliases list in their local Gradio deployment to exclude "null" as a valid origin. By removing this value, the Gradio server will no longer accept requests from sandboxed iframes or sources with a null origin, mitigating the potential for exploitation.
Recommended action: Upgrade to 5.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? This vulnerability relates to the bypass of directory traversal checks within the isinorequal function. This function, intended to check if a file resides within a given directory, can be bypassed with certain payloads that manipulate file paths using .. (parent directory) sequences. Attackers could potentially access restricted files if they are able to exploit this flaw, although the difficulty is high. This primarily impacts users relying on Gradio’s blocklist or directory access validation, particularly when handling file uploads. Patches Yes, please upgrade to gradio=5.0 to address this issue. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? As a workaround, users can manually sanitize and normalize file paths in their Gradio deployment before passing them to the isinorequal function. Ensuring that all file paths are properly resolved and absolute can help mitigate the bypass…
Recommended action: Upgrade to 5.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? This vulnerability is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio server. Potentially, attackers can upload files, steal authentication tokens, and access user data if the victim visits a malicious website while logged into Gradio. This impacts users who have deployed Gradio locally and use basic authentication. Patches Yes, please upgrade to gradio=4.44 to address this issue. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? As a workaround, users can manually enforce stricter CORS origin validation by modifying the CustomCORSMiddleware class in their local Gradio server code. Specifically, they can bypass the condition that skips CORS validation for requests containing cookies to prevent potential exploitation.
Recommended action: Upgrade to 4.44.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This vulnerability allows users of Gradio applications that have a public link (such as on Hugging Face Spaces) to access files on the machine hosting the Gradio application. This involves intercepting and modifying the network requests made by the Gradio app to the server. Patches Yes, the problem has been patched in Gradio version 4.19.2 or higher. We have no knowledge of this exploit being used against users of Gradio applications, but we encourage all users to upgrade to Gradio 4.19.2 or higher. Fixed in: https://github.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7 CVE: https://nvd.nist.gov/vuln/detail/CVE-2024-1728
Recommended action: Upgrade to 4.19.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio and was discovered in version 4.25. The vulnerability arises from improper input validation in the postprocess() function within gradio/components/jsoncomponent.py, where a user-controlled string is parsed as JSON. If the parsed JSON object contains a path key, the specified file is moved to a temporary directory, making it possible to retrieve it later via the /file=.. endpoint. This issue is due to the processingutils.movefilestocache() function traversing any object passed to it, looking for a dictionary with a path key, and then copying the specified file to a temporary directory. The vulnerability can be exploited by an attacker to read files on the remote system, posing a significant security risk.
Recommended action: Upgrade to 4.31.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.