gradio-app vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-49119 Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape High 8.7 · Jul 1, 2026
• CVE-2026-48545 Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a sharHigh 7.6 · May 27, 2026
• CVE-2026-28416 Gradio is an open-source Python package designed for quick prototyping.High 8.2 · Feb 27, 2026
• CVE-2026-28414 Gradio is an open-source Python package designed for quick prototyping.High 7.5 · Feb 27, 2026
• CVE-2025-0187 A Denial of Service (DoS) vulnerability was discovered in the file upload feature of gradio-app/gradio version 0.39.1.High 7.5 · Mar 20, 2025
• CVE-2024-8966 A vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 allows for a Denial of Service (DoS) attack.High 7.5 · Mar 20, 2025
• CVE-2024-10648 A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae.High 8.2 · Mar 20, 2025
• CVE-2024-10624 A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component.High 7.5 · Mar 20, 2025
• CVE-2024-10569 A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack.High 7.5 · Mar 20, 2025
• CVE-2025-23042 Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python functiHigh 8.7 · Jan 14, 2025
• CVE-2024-47871 Gradio is an open-source Python package designed for quick prototyping.High 8.2 · Oct 10, 2024
• CVE-2024-47870 Gradio is an open-source Python package designed for quick prototyping.High 7.1 · Oct 10, 2024
• CVE-2024-4941 A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25.High 7.5 · Jun 6, 2024
• CVE-2024-4325 A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_High 8.6 · Jun 6, 2024
• CVE-2024-4254 The 'deploy-website.yml' workflow in the gradio-app/gradio repository, specifically in the 'main' branch, is vulnerable to secrets exfiltration due to improper High 7.1 · Jun 4, 2024
• CVE-2024-4253 A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow.Critical 9.1 · Jun 4, 2024
• CVE-2024-1561 An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of any method on a `Component` class with High 7.5 · Apr 15, 2024
• CVE-2024-1728 gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component.High 7.5 · Apr 10, 2024
• CVE-2024-1540 A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special eHigh 8.2 · Mar 27, 2024
• CVE-2024-0964 A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.Critical 9.4 · Feb 5, 2024
• CVE-2023-6572 Command Injection in GitHub repository gradio-app/gradio prior to main.High 8.1 · Dec 14, 2023
• CVE-2023-34239 Gradio is an open-source Python library that is used to build machine learning and data science.High 7.3 · Jun 7, 2023
• CVE-2022-24770 `gradio` is an open source framework for building interactive machine learning models and demos.High 8.8 · Mar 17, 2022
• CVE-2021-43831 Gradio is an open source framework for building interactive machine learning models and demos.High 7.7 · Dec 15, 2021