Gradio

Patch now: confirmed exploitation or KEV · 0

Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.

No record for Gradio has confirmed exploitation or a KEV flag.

Disclosed CVEs, no confirmed exploitation · 57

1. 2026-07-08
   CVE-2026-59806

   Gradio SSRF and Open Redirect Vulnerability CVE-2026-59806

   2 Disclosedssrf · open-redirect

   record AIR-2026-0037NVD ↗
2. 2026-07-01
   CVE-2026-49119

   Gradio FileExplorer Path Traversal Vulnerability CVE-2026-49119

   2 Disclosedpath-traversal · arbitrary-file-read

   record AIR-2026-0036GitHub Advisory Database ↗
3. 2026-06-04
   CVE-2026-10783

   CVE-2026-10783: Gradio audio cache key ignores metadata in hash generation

   2 Disclosedgradio

   record AIR-2026-0724GitHub Advisory Database ↗
4. 2026-05-27
   CVE-2026-48545

   CVE-2026-48545: Gradio cookie injection leads to cross-Space session fixation

   2 Disclosedcookieinjection · sessionfixation

   record AIR-2026-0021NVD ↗
5. 2026-02-27
   CVE-2026-28415

   CVE-2026-28415: Gradio Open Redirect in OAuth Flow

   2 Disclosedopen-redirect · gradio

   record AIR-2026-0488NVD ↗
6. 2026-02-27
   CVE-2026-28414

   CVE-2026-28414: Gradio Path Traversal Vulnerability on Windows

   2 Disclosedpath-traversal · gradio

   record AIR-2026-0487NVD ↗
7. 2026-02-27
   CVE-2026-27167

   CVE-2026-27167: Gradio Mocked OAuth Login Exposes Server Credentials

   2 Disclosedoauth · credential-theft · gradio

   record AIR-2026-0486NVD ↗
8. 2026-02-27
   CVE-2026-28416

   CVE-2026-28416: Gradio SSRF via Malicious proxy_url Injection

   2 Disclosedssrf · gradio

   record AIR-2026-0485NVD ↗
9. 2025-05-29
   CVE-2025-5320

   CVE-2025-5320: Gradio CORS Origin Validation Bypass Vulnerability

   2 Disclosedgradio · cors

   record AIR-2025-0294GitHub Advisory Database ↗
10. 2025-05-29
    CVE-2025-48889

    CVE-2025-48889: Gradio Arbitrary File Copy Vulnerability

    2 Disclosedgradio · path-manipulation

    record AIR-2025-0293GitHub Advisory Database ↗
11. 2025-03-20
    CVE-2025-0187

    CVE-2025-0187: Denial of service vulnerability in Gradio file upload feature

    2 Discloseddos · infra_vuln

    record AIR-2025-0407NVD ↗
12. 2025-03-20
    CVE-2024-10707

    CVE-2024-10707: Local file inclusion vulnerability in ChuanhuChatGPT

    2 Disclosedlfi · infra_vuln

    record AIR-2025-0405NVD ↗
13. 2025-03-20
    CVE-2024-8021

    CVE-2024-8021: Gradio Open Redirect Vulnerability Disclosed

    2 Disclosedopen-redirect · gradio

    record AIR-2025-0257GitHub Advisory Database ↗
14. 2025-03-20
    CVE-2024-10569

    CVE-2024-10569: Gradio vulnerable to denial of service via zip bomb

    2 Discloseddenial-of-service · zip-bomb

    record AIR-2025-0248GitHub Advisory Database ↗
15. 2025-03-20
    CVE-2024-10648

    CVE-2024-10648: Gradio Vulnerable to Arbitrary File Deletion

    2 Disclosedpath-traversal · denial-of-service

    record AIR-2025-0239GitHub Advisory Database ↗
16. 2025-03-20
    CVE-2024-8966

    CVE-2024-8966: Gradio denial of service via multipart boundary file upload

    2 Discloseddenial-of-service · gradio

    record AIR-2025-0236GitHub Advisory Database ↗
17. 2025-03-20
    CVE-2024-12217

    CVE-2024-12217: Gradio Path Traversal via NTFS Alternate Data Streams

    2 Disclosedpath-traversal · gradio

    record AIR-2025-0222GitHub Advisory Database ↗
18. 2025-03-20
    CVE-2024-10624

    CVE-2024-10624: Gradio Vulnerable to Denial of Service via Crafted HTTP Request

    2 Disclosedredos · denial-of-service

    record AIR-2025-0209GitHub Advisory Database ↗
19. 2025-01-14
    CVE-2025-23042

    CVE-2025-23042: Gradio blocked path ACL bypass vulnerability

    2 Disclosedacl-bypass

    record AIR-2025-0195GitHub Advisory Database ↗
20. 2024-11-06
    CVE-2024-51751

    CVE-2024-51751: Arbitrary file read vulnerability in Gradio components

    2 Disclosedarbitrary-file-read

    record AIR-2024-0200GitHub Advisory Database ↗
21. 2024-11-04
    CVE-2024-48052

    CVE-2024-48052: Gradio Server Side Request Forgery Vulnerability

    2 Disclosedgradio · ssrf

    record AIR-2024-0198NVD ↗
22. 2024-10-10
    CVE-2024-47867

    CVE-2024-47867: Gradio lacks FRP client integrity checking

    2 Disclosedintegrity-check · gradio

    record AIR-2024-0189GitHub Advisory Database ↗
23. 2024-10-10
    CVE-2024-47868

    CVE-2024-47868: Gradio component post-processing file leaks

    2 Disclosedfile-leak · gradio

    record AIR-2024-0188GitHub Advisory Database ↗
24. 2024-10-10
    CVE-2024-47872

    CVE-2024-47872: Gradio cross-site scripting via file uploads

    2 Disclosedxss · gradio

    record AIR-2024-0187GitHub Advisory Database ↗
25. 2024-10-10
    CVE-2024-47869

    CVE-2024-47869: Gradio non-constant-time hash comparison

    2 Disclosedtiming-attack · gradio

    record AIR-2024-0186GitHub Advisory Database ↗
26. 2024-10-10
    CVE-2024-47164

    CVE-2024-47164: Gradio directory traversal vulnerability

    2 Disclosedpath-traversal · gradio

    record AIR-2024-0185GitHub Advisory Database ↗
27. 2024-10-10
    CVE-2024-47166

    CVE-2024-47166: Gradio path traversal in custom component endpoint

    2 Disclosedgradio · path-traversal

    record AIR-2024-0184GitHub Advisory Database ↗
28. 2024-10-10
    CVE-2024-47167

    CVE-2024-47167: Gradio vulnerable to SSRF in queue join endpoint

    2 Disclosedgradio · ssrf

    record AIR-2024-0183GitHub Advisory Database ↗
29. 2024-10-10
    CVE-2024-47168

    CVE-2024-47168: Gradio monitoring endpoint accessible when disabled

    2 Disclosedgradio · data-exposure

    record AIR-2024-0182GitHub Advisory Database ↗
30. 2024-10-10
    CVE-2024-47165

    CVE-2024-47165: Gradio CORS origin validation accepts null origin

    2 Disclosedgradio · cors

    record AIR-2024-0181GitHub Advisory Database ↗
31. 2024-10-10
    Gradio dropdown validation bypass vulnerability

    2 Disclosedghsa-26jh-r8g2-6fpr · gradio · input-validation

    record AIR-2024-0180GitHub Advisory Database ↗
32. 2024-10-10
    CVE-2024-47871

    CVE-2024-47871: Gradio uses insecure communication between FRP client and server

    2 Disclosedinsecure-communication · gradio

    record AIR-2024-0179GitHub Advisory Database ↗
33. 2024-10-10
    CVE-2024-47870

    CVE-2024-47870: Gradio race condition allows traffic redirection

    2 Disclosedrace-condition · gradio

    record AIR-2024-0178GitHub Advisory Database ↗
34. 2024-10-10
    CVE-2024-47084

    CVE-2024-47084: Gradio lacks CORS origin validation when cookies are present

    2 Disclosedcors · gradio

    record AIR-2024-0177GitHub Advisory Database ↗
35. 2024-07-01
    CVE-2024-39236

    CVE-2024-39236: Code injection vulnerability in Gradio component_meta.py

    2 Disclosedcode_injection · infra_vuln

    record AIR-2024-0244NVD ↗
36. 2024-06-22
    CVE-2024-4940

    CVE-2024-4940: Open redirect vulnerability in gradio

    2 Disclosedopen-redirect

    record AIR-2024-0142GitHub Advisory Database ↗
37. 2024-06-06
    CVE-2024-4325

    CVE-2024-4325: SSRF Vulnerability in Gradio

    2 Disclosedssrf · gradio

    record AIR-2024-0134GitHub Advisory Database ↗
38. 2024-06-06
    CVE-2024-4941

    CVE-2024-4941: Local file inclusion in Gradio JSON component

    2 Disclosedlfi · path_traversal

    record AIR-2024-0126GitHub Advisory Database ↗
39. 2024-06-04
    CVE-2024-4254

    CVE-2024-4254: Gradio Website Deployment Workflow Secrets Exfiltration

    2 Disclosedinfra_vuln

    record AIR-2024-0236NVD ↗
40. 2024-06-04
    CVE-2024-4253

    CVE-2024-4253: Gradio Repository Workflow Command Injection Vulnerability

    2 Disclosedinfra_vuln

    record AIR-2024-0235NVD ↗
41. 2024-05-05
    CVE-2024-34510

    CVE-2024-34510: Gradio credential leakage vulnerability on Windows

    2 Disclosedgradio · credential_leak

    record AIR-2024-0103GitHub Advisory Database ↗
42. 2024-05-05
    CVE-2024-34511

    CVE-2024-34511: Gradio component server function handling flaw

    2 Disclosedgradio · infra_vuln

    record AIR-2024-0102GitHub Advisory Database ↗
43. 2024-04-16
    CVE-2024-1183

    Gradio Server-Side Request Forgery Vulnerability

    2 Disclosedssrf

    record AIR-2024-0097GitHub Advisory Database ↗
44. 2024-04-16
    CVE-2024-1561

    CVE-2024-1561: gradio vulnerable to Path Traversal

    2 Disclosedpath-traversal

    record AIR-2024-0087GitHub Advisory Database ↗
45. 2024-04-10
    CVE-2024-1728

    CVE-2024-1728: Gradio arbitrary file access vulnerability

    2 Disclosedpath-traversal

    record AIR-2024-0172NVD ↗
46. 2024-04-10
    Gradio Local File Inclusion Vulnerability in UploadButton

    2 Disclosedlfi · gradio · infra_vuln

    record AIR-2024-0084GitHub Advisory Database ↗
47. 2024-03-27
    CVE-2024-1540

    CVE-2024-1540: Gradio Workflow Command Injection Vulnerability

    2 Disclosedcommand-injection

    record AIR-2024-0218NVD ↗
48. 2024-03-27
    CVE-2024-2206

    CVE-2024-2206: Gradio Server-Side Request Forgery vulnerability

    2 Disclosedssrf · gradio

    record AIR-2024-0081GitHub Advisory Database ↗
49. 2024-03-21
    CVE-2024-1727

    CVE-2024-1727: Gradio Local Route Access Vulnerability

    2 Disclosedunauthorized-access

    record AIR-2024-0111NVD ↗
50. 2024-02-22
    CVE-2024-1729

    CVE-2024-1729: Gradio apps vulnerable to timing attacks to guess password

    2 Disclosedtiming-attack · brute-force

    record AIR-2024-0074GitHub Advisory Database ↗
51. 2024-02-05
    CVE-2024-0964

    CVE-2024-0964: Gradio Path Traversal Vulnerability

    2 Disclosedpath-traversal · gradio

    record AIR-2024-0072NVD ↗
52. 2023-12-21
    CVE-2023-51449

    CVE-2023-51449: File traversal and SSRF vulnerability in Gradio

    2 Disclosedpath-traversal · ssrf

    record AIR-2023-0082GitHub Advisory Database ↗
53. 2023-12-14
    CVE-2023-6572

    CVE-2023-6572: Information exposure vulnerability in Gradio

    2 Disclosedinformation-disclosure

    record AIR-2023-0076GitHub Advisory Database ↗
54. 2023-09-15
    CVE-2023-41626

    CVE-2023-41626: Arbitrary file upload vulnerability in Gradio upload interface

    2 Disclosedarbitrary-file-upload

    record AIR-2023-0086NVD ↗
55. 2023-06-08
    CVE-2023-34239

    CVE-2023-34239: Gradio arbitrary file read and URL proxying vulnerabilities

    2 Disclosedarbitrary-file-read

    record AIR-2023-0048NVD ↗
56. 2023-02-23
    CVE-2023-25823

    CVE-2023-25823: Gradio exposes private SSH keys in share links

    2 Disclosedgradio · information-disclosure

    record AIR-2023-0037GitHub Advisory Database ↗
57. 2021-12-15
    CVE-2021-43831

    CVE-2021-43831: Local file access vulnerability in Gradio interface

    2 Disclosedpath_traversal · gradio

    record AIR-2022-0040NVD ↗