gradio-app vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20221
3. 20234
4. 202426
5. 202510
6. 20268

Newest CVEs

• CVE-2026-59806

  Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint

  gradio-app · gradio

  Medium4.9
• CVE-2026-49119

  Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()

  gradio-app · gradio

  High8.7
• CVE-2026-10783

  gradio-app gradio Audio Cache Key save_audio_to_cache weak hash

  gradio-app · gradio

  Low2.0
• CVE-2026-48545

  Gradio < 6.15.0 Cookie Injection via Shared Proxy Client

  gradio-app · gradio

  High7.6
• CVE-2026-28416

  Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing

  gradio-app · gradio

  High8.2
• CVE-2026-28415

  Gradio has Open Redirect in OAuth Flow

  gradio-app · gradio

  Medium4.3
• CVE-2026-28414

  Gradio has Absolute Path Traversal on Windows with Python 3.13+

  gradio-app · gradio

  High7.5
• CVE-2026-27167

  Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret

  gradio-app · gradio

  None0.0
• CVE-2025-48889

  Gradio Allows Unauthorized File Copy via Path Manipulation

  gradio-app · gradio

  Medium5.3
• CVE-2025-5320

  gradio-app gradio CORS is_valid_origin privilege escalation

  gradio-app · gradio

  Medium6.3