MEDIUM5.3PyPI
GHSA-26jh-r8g2-6fprGradio's dropdown component pre-process step does not limit the values to those in the dropdown list
Modified: 9/10/2026
package
PyPI/gradio
pkg:pypi/gradio
HIGH8.1PyPI
GHSA-279j-x4gx-hfrh· CVE-2024-47871, PYSEC-2024-219Gradio uses insecure communication between the FRP client and server
Modified: 1/21/2025
MEDIUM6.5PyPI
GHSA-34rf-p3r3-58x2· CVE-2024-34511, PYSEC-2026-1407Gradio's Component Server does not properly consider` _is_server_fn` for functions
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-37qc-qgx6-9xjv· CVE-2024-47166, PYSEC-2024-197Gradio has a one-level read path traversal in `/custom_component`
Modified: 1/21/2025
HIGH7.5PyPI
GHSA-39mp-8hj3-5c49· CVE-2026-28414, PYSEC-2026-64Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+
Modified: 6/6/2026
HIGH8.8PyPI
GHSA-3c67-5hwx-f6wx· CVE-2024-47084, PYSEC-2024-196Gradios's CORS origin validation is not performed when the request has a cookie
Modified: 1/21/2025
MEDIUM6.5PyPI
GHSA-3gf9-wv65-gwh9· CVE-2024-48052, PYSEC-2026-1408gradio Server Side Request Forgery vulnerability
Modified: 9/10/2026
HIGH7.3PyPI
GHSA-3qqg-pgqq-3695· CVE-2023-34239, PYSEC-2023-90Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs
Modified: 9/10/2026
MEDIUM5.4PyPI
GHSA-3x5j-9vwr-8rr5· CVE-2023-25823, PYSEC-2023-16Update share links to use FRP instead of SSH tunneling
Modified: 9/10/2026
MEDIUM4.3PyPI
GHSA-48cq-79qq-6f7x· CVE-2024-1727, PYSEC-2026-1409Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading files
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-4q3c-cj7g-jcwf· CVE-2024-47868, PYSEC-2024-217Gradio has several components with post-process steps allow arbitrary file leaks
Modified: 1/21/2025
HIGH7.2PyPI
GHSA-576c-3j53-r9jj· CVE-2024-47167, PYSEC-2024-215Gradio vulnerable to SSRF in the path parameter of /queue/join
Modified: 1/21/2025
HIGH7.5PyPI
GHSA-5cpq-9538-jm2j· CVE-2024-8966, PYSEC-2026-1410Gradio DOS in multipart boundry while uploading the file
Modified: 7/7/2026
LOW2.5PyPI
GHSA-6655-8ph2-63j3· CVE-2026-10783, PYSEC-2026-211Gradio: Audio cache key ignores metadata when saving numpy audio outputs
Modified: 7/14/2026
HIGH8.6PyPI
GHSA-6qm2-wpxq-7qh2· CVE-2023-51449, PYSEC-2023-249Gradio makes the `/file` secure against file traversal and server-side request forgery attacks
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-6v6g-j5fq-hpvw· CVE-2024-4941, PYSEC-2024-184Local file inclusion in gradio
Modified: 10/16/2025
MEDIUM6.5PyPI
GHSA-77xq-6g77-h274· CVE-2024-47164, PYSEC-2024-213Gradio's `is_in_or_equal` function may be bypassed
Modified: 1/21/2025
MEDIUM6.8PyPI
GHSA-7hp7-4p35-3cx2· CVE-2026-48545, PYSEC-2026-2178Gradio contains a cookie injection vulnerability
Modified: 7/13/2026
MEDIUM5.4PyPI
GHSA-7v2w-h4gh-w5cv· CVE-2024-8021, PYSEC-2026-1411Gradio Vulnerable to Open Redirect
Modified: 7/7/2026
HIGH7.5PyPI
GHSA-7xmc-vhjp-qv5q· CVE-2024-10569, PYSEC-2026-1412Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb
Modified: 7/7/2026
MEDIUM5.4PyPI
GHSA-89v2-pqfv-c5r9· CVE-2024-47165, PYSEC-2024-214Gradio's CORS origin validation accepts the null origin
Modified: 1/21/2025
HIGH7.5PyPI
GHSA-8c87-gvhj-xm8m· CVE-2024-47867, PYSEC-2024-216Gradio lacks integrity checking on the downloaded FRP client
Modified: 1/21/2025
MEDIUM5.3PyPI
GHSA-8jw3-6x8j-v96g· CVE-2025-48889, PYSEC-2025-119Gradio Allows Unauthorized File Copy via Path Manipulation
Modified: 6/5/2026
HIGH8.6PyPI
GHSA-973g-55hp-3frw· CVE-2024-4325, PYSEC-2026-1413Server-Side Request Forgery in gradio
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-f3h9-8phc-6gvh· CVE-2024-0964, PYSEC-2024-261Gradio Path Traversal vulnerability
Modified: 5/19/2026
HIGH8.8PyPI
GHSA-f8xq-q7px-wg8c· CVE-2022-24770, PYSEC-2022-229Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging
Modified: 11/8/2023
MEDIUM5.4PyPI
GHSA-g6c9-f4xm-9j4x· CVE-2024-4940, PYSEC-2026-1414Open redirect in gradio
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-g9cj-cfpp-4g2x· CVE-2024-1561, PYSEC-2026-1415gradio vulnerable to Path Traversal
Modified: 9/10/2026
CRITICAL9.6PyPI
GHSA-gqvf-3hgp-5hxv· CVE-2023-6572, PYSEC-2023-255Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Modified: 9/10/2026
MEDIUM5.4PyPI
GHSA-gvv6-33j7-884g· CVE-2024-47872, PYSEC-2024-220Gradio has an XSS on every Gradio server via upload of HTML files, JS files, or SVG files
Modified: 1/21/2025
—0.0PyPI
GHSA-h3h8-3v2v-rg7m· CVE-2026-27167, PYSEC-2026-63Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret
Modified: 6/5/2026
MEDIUM4.3PyPI
GHSA-hm3c-93pg-4cxw· CVE-2024-47168, PYSEC-2024-198In Gradio, the `enable_monitoring` flag set to `False` does not disable monitoring
Modified: 1/21/2025
MEDIUM5.9PyPI
GHSA-hmx6-r76c-85g9· CVE-2024-1729, PYSEC-2026-1416Gradio apps vulnerable to timing attacks to guess password
Modified: 9/10/2026
CRITICALPyPI
GHSA-j2jg-fq62-7c3h· CVE-2025-23042, PYSEC-2025-118Gradio Blocked Path ACL Bypass Vulnerability
Modified: 6/5/2026
LOW3.7PyPI
GHSA-j757-pf57-f8r4· CVE-2024-47869, PYSEC-2024-199Gradio performs a non-constant-time comparison when comparing hashes
Modified: 1/21/2025
HIGH8.2PyPI
GHSA-jmh7-g254-2cq9· CVE-2026-28416, PYSEC-2026-66Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing
Modified: 6/6/2026
HIGH8.1PyPI
GHSA-m842-4qm8-7gpq· CVE-2024-1728, PYSEC-2026-345Gradio allows users to access arbitrary files
Modified: 6/29/2026
MEDIUM4.3PyPI
GHSA-pfjf-5gxr-995x· CVE-2026-28415, PYSEC-2026-65Gradio has an Open Redirect in its OAuth Flow
Modified: 6/6/2026
HIGH8.2PyPI
GHSA-pgfv-gvc5-prfg· CVE-2024-10648, PYSEC-2026-1417Gradio Vulnerable to Arbitrary File Deletion
Modified: 7/7/2026
MEDIUM5.3PyPI
GHSA-prpg-p95c-32fv· CVE-2024-12217, PYSEC-2026-1418Gradio Path Traversal vulnerability
Modified: 7/7/2026
MEDIUM6.5PyPI
GHSA-qh6x-j82h-vpf9· CVE-2024-1183, PYSEC-2026-1419gradio Server-Side Request Forgery vulnerability
Modified: 9/10/2026
HIGH7.3PyPI
GHSA-r364-m2j9-mf4h· CVE-2024-2206, PYSEC-2026-1420gradio Server-Side Request Forgery vulnerability
Modified: 9/10/2026
—0.0PyPI
GHSA-rhm9-gp5p-5248· CVE-2024-51751, PYSEC-2024-275Gradio vulnerable to arbitrary file read with File and UploadButton components
Modified: 6/5/2026
HIGH8.3PyPI
GHSA-rhq2-3vr9-6mcr· CVE-2021-43831, PYSEC-2021-873Files on the host computer can be accessed from the Gradio interface
Modified: 7/8/2026
HIGH7.5PyPI
GHSA-rvfh-h6c7-fc3c· CVE-2024-34510, PYSEC-2024-255Gradio allows credential leakage on Windows
Modified: 6/17/2025
HIGH7.5PyPI
GHSA-rvgh-pr46-x7gg· CVE-2024-10624, PYSEC-2026-1421Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
Modified: 7/7/2026
MEDIUM4.8PyPI
GHSA-v4q9-qgqf-7jwp· CVE-2023-41626, PYSEC-2026-1422Gradio arbitrary file upload vulnerability
Modified: 7/7/2026
LOW3.7PyPI
GHSA-wmjh-cpqj-4v6x· CVE-2025-5320, PYSEC-2026-1423Gradio CORS Origin Validation Bypass Vulnerability
Modified: 7/7/2026
HIGH7.0PyPI
GHSA-xh2x-3mrm-fwqm· CVE-2024-47870, PYSEC-2024-218Gradio has a race condition in update_root_in_config may redirect user traffic
Modified: 1/21/2025
—PyPI
PYSEC-2021-873· CVE-2021-43831, GHSA-rhq2-3vr9-6mcrModified: 11/8/2023
—PyPI
PYSEC-2022-229· CVE-2022-24770, GHSA-f8xq-q7px-wg8cModified: 11/8/2023
—PyPI
PYSEC-2023-16· CVE-2023-25823, GHSA-3x5j-9vwr-8rr5Modified: 11/8/2023
HIGH7.5PyPI
PYSEC-2023-249· CVE-2023-51449, GHSA-6qm2-wpxq-7qh2Modified: 1/17/2024
HIGH8.1PyPI
PYSEC-2023-255· CVE-2023-6572, GHSA-gqvf-3hgp-5hxvModified: 6/10/2026
—PyPI
PYSEC-2023-90· CVE-2023-34239, GHSA-3qqg-pgqq-3695Modified: 11/8/2023
HIGH7.5PyPI
PYSEC-2024-184· CVE-2024-4941, GHSA-6v6g-j5fq-hpvwModified: 6/10/2026
HIGH8.3PyPI
PYSEC-2024-196· CVE-2024-47084, GHSA-3c67-5hwx-f6wxModified: 1/19/2025
MEDIUM5.3PyPI
PYSEC-2024-197· CVE-2024-47166, GHSA-37qc-qgx6-9xjvModified: 1/19/2025
MEDIUM4.3PyPI
PYSEC-2024-198· CVE-2024-47168, GHSA-hm3c-93pg-4cxwModified: 1/19/2025
LOW3.7PyPI
PYSEC-2024-199· CVE-2024-47869, GHSA-j757-pf57-f8r4Modified: 1/19/2025
MEDIUM6.5PyPI
PYSEC-2024-213· CVE-2024-47164, GHSA-77xq-6g77-h274Modified: 1/19/2025
MEDIUM5.4PyPI
PYSEC-2024-214· CVE-2024-47165, GHSA-89v2-pqfv-c5r9Modified: 1/19/2025
CRITICAL9.8PyPI
PYSEC-2024-215· CVE-2024-47167, GHSA-576c-3j53-r9jjModified: 1/19/2025
HIGH7.5PyPI
PYSEC-2024-216· CVE-2024-47867, GHSA-8c87-gvhj-xm8mModified: 1/19/2025
HIGH7.5PyPI
PYSEC-2024-217· CVE-2024-47868, GHSA-4q3c-cj7g-jcwfModified: 1/19/2025
HIGH8.1PyPI
PYSEC-2024-218· CVE-2024-47870, GHSA-xh2x-3mrm-fwqmModified: 1/19/2025
CRITICAL9.1PyPI
PYSEC-2024-219· CVE-2024-47871, GHSA-279j-x4gx-hfrhModified: 1/19/2025
MEDIUM5.4PyPI
PYSEC-2024-220· CVE-2024-47872, GHSA-gvv6-33j7-884gModified: 1/19/2025
—PyPI
PYSEC-2024-255· CVE-2024-34510, GHSA-rvfh-h6c7-fc3cModified: 6/10/2026
CRITICAL9.4PyPI
PYSEC-2024-261· CVE-2024-0964, GHSA-f3h9-8phc-6gvhModified: 6/10/2026
CRITICAL9.8PyPI
PYSEC-2024-274· CVE-2024-39236, GHSA-9v2f-6vcg-3hgvModified: 5/21/2026
MEDIUM6.5PyPI
PYSEC-2024-275· CVE-2024-51751, GHSA-rhm9-gp5p-5248Modified: 5/20/2026
CRITICAL9.1PyPI
PYSEC-2024-321· CVE-2024-4253Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2025-118· CVE-2025-23042, GHSA-j2jg-fq62-7c3hModified: 5/20/2026
HIGH7.5PyPI
PYSEC-2025-119· CVE-2025-48889, GHSA-8jw3-6x8j-v96gModified: 5/20/2026
MEDIUM6.5PyPI
PYSEC-2026-1407· CVE-2024-34511, GHSA-34rf-p3r3-58x2Gradio's Component Server does not properly consider` _is_server_fn` for functions
Modified: 7/7/2026
MEDIUM6.5PyPI
PYSEC-2026-1408· CVE-2024-48052, GHSA-3gf9-wv65-gwh9gradio Server Side Request Forgery vulnerability
Modified: 7/7/2026
MEDIUM4.3PyPI
PYSEC-2026-1409· CVE-2024-1727, GHSA-48cq-79qq-6f7xGradio applications running locally vulnerable to 3rd party websites accessing routes and uploading files
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1410· CVE-2024-8966, GHSA-5cpq-9538-jm2jGradio DOS in multipart boundry while uploading the file
Modified: 7/7/2026
MEDIUM5.4PyPI
PYSEC-2026-1411· CVE-2024-8021, GHSA-7v2w-h4gh-w5cvGradio Vulnerable to Open Redirect
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1412· CVE-2024-10569, GHSA-7xmc-vhjp-qv5qGradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb
Modified: 7/7/2026
HIGH8.6PyPI
PYSEC-2026-1413· CVE-2024-4325, GHSA-973g-55hp-3frwServer-Side Request Forgery in gradio
Modified: 7/7/2026
MEDIUM5.4PyPI
PYSEC-2026-1414· CVE-2024-4940, GHSA-g6c9-f4xm-9j4xOpen redirect in gradio
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1415· CVE-2024-1561, GHSA-g9cj-cfpp-4g2xgradio vulnerable to Path Traversal
Modified: 7/7/2026
MEDIUM5.9PyPI
PYSEC-2026-1416· CVE-2024-1729, GHSA-hmx6-r76c-85g9Gradio apps vulnerable to timing attacks to guess password
Modified: 7/7/2026
HIGH8.2PyPI
PYSEC-2026-1417· CVE-2024-10648, GHSA-pgfv-gvc5-prfgGradio Vulnerable to Arbitrary File Deletion
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-1418· CVE-2024-12217, GHSA-prpg-p95c-32fvGradio Path Traversal vulnerability
Modified: 7/7/2026
MEDIUM6.5PyPI
PYSEC-2026-1419· CVE-2024-1183, GHSA-qh6x-j82h-vpf9gradio Server-Side Request Forgery vulnerability
Modified: 7/7/2026
HIGH7.3PyPI
PYSEC-2026-1420· CVE-2024-2206, GHSA-r364-m2j9-mf4hgradio Server-Side Request Forgery vulnerability
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1421· CVE-2024-10624, GHSA-rvgh-pr46-x7ggGradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
Modified: 7/7/2026
MEDIUM4.8PyPI
PYSEC-2026-1422· CVE-2023-41626, GHSA-v4q9-qgqf-7jwpGradio arbitrary file upload vulnerability
Modified: 7/7/2026
LOW3.7PyPI
PYSEC-2026-1423· CVE-2025-5320, GHSA-wmjh-cpqj-4v6xGradio CORS Origin Validation Bypass Vulnerability
Modified: 7/7/2026
LOW2.5PyPI
PYSEC-2026-211· CVE-2026-10783, GHSA-6655-8ph2-63j3Modified: 7/23/2026
MEDIUM6.8PyPI
PYSEC-2026-2178· CVE-2026-48545, GHSA-7hp7-4p35-3cx2Modified: 7/13/2026
—PyPI
PYSEC-2026-2179· CVE-2026-49119Modified: 7/13/2026
HIGH8.1PyPI
PYSEC-2026-345· CVE-2024-1728, GHSA-m842-4qm8-7gpqGradio allows users to access arbitrary files
Modified: 7/1/2026
MEDIUM5.9PyPI
PYSEC-2026-63· CVE-2026-27167, GHSA-h3h8-3v2v-rg7mModified: 5/20/2026
HIGH7.5PyPI
PYSEC-2026-64· CVE-2026-28414, GHSA-39mp-8hj3-5c49Modified: 5/20/2026
MEDIUM4.7PyPI
PYSEC-2026-65· CVE-2026-28415, GHSA-pfjf-5gxr-995xModified: 5/20/2026
HIGH8.6PyPI
PYSEC-2026-66· CVE-2026-28416, GHSA-jmh7-g254-2cq9Modified: 5/20/2026