Vulnerabilities for gradio

First version without a known vulnerability: 6.16.0

Details

• PYSEC-2026-21792026-07-01

  Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape the configured root directory by supplying path segments containing directory traversal sequences or absolute paths. Attackers can provide crafted path segments that cause os.path.join to discard the root_dir prefix entirely, resulting in arbitrary file read or exposure of sensitive files outside the intended directory.

  Fixed in: 6.16.0

• GHSA-6655-8ph2-63j32026-06-04

  Gradio: Audio cache key ignores metadata when saving numpy audio outputs

  Fixed in: 6.15.1

• GHSA-7hp7-4p35-3cx22026-05-27

  Gradio contains a cookie injection vulnerability

  Fixed in: 6.15.0

• GHSA-jmh7-g254-2cq92026-03-01

  Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing

  Fixed in: 6.6.0

• GHSA-pfjf-5gxr-995x2026-03-01

  Gradio has an Open Redirect in its OAuth Flow

  Fixed in: 6.6.0

• GHSA-39mp-8hj3-5c492026-03-01

  Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+

  Fixed in: 6.7.0

• GHSA-h3h8-3v2v-rg7m2026-03-01

  Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret

  Fixed in: 6.6.0

• GHSA-8jw3-6x8j-v96g2025-05-29

  Gradio Allows Unauthorized File Copy via Path Manipulation

  Fixed in: 5.31.0

• GHSA-wmjh-cpqj-4v6x2025-05-29

  Gradio CORS Origin Validation Bypass Vulnerability

• GHSA-5cpq-9538-jm2j2025-03-20

  Gradio DOS in multipart boundry while uploading the file

• GHSA-7v2w-h4gh-w5cv2025-03-20

  Gradio Vulnerable to Open Redirect

• GHSA-prpg-p95c-32fv2025-03-20

  Gradio Path Traversal vulnerability

• GHSA-7xmc-vhjp-qv5q2025-03-20

  Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb

• GHSA-pgfv-gvc5-prfg2025-03-20

  Gradio Vulnerable to Arbitrary File Deletion

• GHSA-rvgh-pr46-x7gg2025-03-20

  Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

• GHSA-j2jg-fq62-7c3h2025-01-14

  Gradio Blocked Path ACL Bypass Vulnerability

  Fixed in: 5.11.0, 5.6.0

• GHSA-rhm9-gp5p-52482024-11-06

  Gradio vulnerable to arbitrary file read with File and UploadButton components

  Fixed in: 5.5.0

• GHSA-3gf9-wv65-gwh92024-11-05

  gradio Server Side Request Forgery vulnerability

• GHSA-26jh-r8g2-6fpr2024-10-10

  Gradio's dropdown component pre-process step does not limit the values to those in the dropdown list

  Fixed in: 5.0.0

• GHSA-gvv6-33j7-884g2024-10-10

  Gradio has an XSS on every Gradio server via upload of HTML files, JS files, or SVG files

  Fixed in: 5.0.0

• GHSA-279j-x4gx-hfrh2024-10-10

  Gradio uses insecure communication between the FRP client and server

  Fixed in: 5.0.0

• GHSA-xh2x-3mrm-fwqm2024-10-10

  Gradio has a race condition in update_root_in_config may redirect user traffic

  Fixed in: 5.0.0

• GHSA-j757-pf57-f8r42024-10-10

  Gradio performs a non-constant-time comparison when comparing hashes

  Fixed in: 4.44.0

• GHSA-4q3c-cj7g-jcwf2024-10-10

  Gradio has several components with post-process steps allow arbitrary file leaks

  Fixed in: 5.0.0

• GHSA-8c87-gvhj-xm8m2024-10-10

  Gradio lacks integrity checking on the downloaded FRP client

  Fixed in: 5.0.0

• GHSA-hm3c-93pg-4cxw2024-10-10

  In Gradio, the `enable_monitoring` flag set to `False` does not disable monitoring

  Fixed in: 4.44.0

• GHSA-576c-3j53-r9jj2024-10-10

  Gradio vulnerable to SSRF in the path parameter of /queue/join

  Fixed in: 5.0.0

• GHSA-37qc-qgx6-9xjv2024-10-10

  Gradio has a one-level read path traversal in `/custom_component`

  Fixed in: 4.44.0

• GHSA-89v2-pqfv-c5r92024-10-10

  Gradio's CORS origin validation accepts the null origin

  Fixed in: 5.0.0

• GHSA-77xq-6g77-h2742024-10-10

  Gradio's `is_in_or_equal` function may be bypassed

  Fixed in: 5.0.0

• GHSA-3c67-5hwx-f6wx2024-10-10

  Gradios's CORS origin validation is not performed when the request has a cookie

  Fixed in: 4.44.0

• GHSA-m842-4qm8-7gpq2024-09-25

  Gradio allows users to access arbitrary files

  Fixed in: 4.19.2

• PYSEC-2024-2742024-07-01

  Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is triggered via a crafted input. NOTE: the supplier disputes this because the report is about a user attacking himself.

• GHSA-g6c9-f4xm-9j4x2024-06-22

  Open redirect in gradio

• GHSA-6v6g-j5fq-hpvw2024-06-06

  Local file inclusion in gradio

  Fixed in: 4.31.3, ee1e2942e0a1ae84a08a05464e41c8108a03fa9c, 4.31.4

• GHSA-973g-55hp-3frw2024-06-06

  Server-Side Request Forgery in gradio

• PYSEC-2024-3212024-06-04

  A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modification of the base repository or secrets exfiltration. The issue affects versions up to and including '@gradio/video@0.6.12'. The flaw is present in the workflow's handling of GitHub context information, where it echoes the full name of the head repository, the head branch, and the workflow reference without adequate sanitization. This could potentially lead to the exfiltration of sensitive secrets such as 'GITHUB_TOKEN', 'COMMENT_TOKEN', and 'CHROMATIC_PROJECT_TOKEN'.

  Fixed in: 4.29.0

• GHSA-48cq-79qq-6f7x2024-05-21

  Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading files

  Fixed in: 4.19.2

• GHSA-34rf-p3r3-58x22024-05-05

  Gradio's Component Server does not properly consider` _is_server_fn` for functions

  Fixed in: 4.13.0

• GHSA-rvfh-h6c7-fc3c2024-05-05

  Gradio allows credential leakage on Windows

  Fixed in: 4.20.0

• GHSA-g9cj-cfpp-4g2x2024-04-16

  gradio vulnerable to Path Traversal

  Fixed in: 4.13.0

• GHSA-qh6x-j82h-vpf92024-04-16

  gradio Server-Side Request Forgery vulnerability

  Fixed in: 4.10.0

• GHSA-r364-m2j9-mf4h2024-03-27

  gradio Server-Side Request Forgery vulnerability

  Fixed in: 4.18.0

• GHSA-hmx6-r76c-85g92024-02-22

  Gradio apps vulnerable to timing attacks to guess password

  Fixed in: 4.19.2

• GHSA-f3h9-8phc-6gvh2024-02-06

  Gradio Path Traversal vulnerability

  Fixed in: 4.9.0

• GHSA-6qm2-wpxq-7qh22023-12-21

  Gradio makes the `/file` secure against file traversal and server-side request forgery attacks

  Fixed in: 4.11.0, 1b9d4234d6c25ef250d882c7b90e1f4039ed2d76, 7ba8c5da45b004edd12c0460be9222f5b5f5f055

• GHSA-gqvf-3hgp-5hxv2023-12-14

  Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability

  Fixed in: 4.14.0, 5b5af1899dd98d63e1f9b48a93601c2db1f56520

• GHSA-v4q9-qgqf-7jwp2023-09-16

  Gradio arbitrary file upload vulnerability

• GHSA-3qqg-pgqq-36952023-06-09

  Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs

  Fixed in: 3.34.0

• GHSA-3x5j-9vwr-8rr52023-02-23

  Update share links to use FRP instead of SSH tunneling

  Fixed in: 3.13.1

• GHSA-f8xq-q7px-wg8c2022-03-18

  Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging

  Fixed in: 2.8.11, 80fea89117358ee105973453fdc402398ae20239

• GHSA-rhq2-3vr9-6mcr2022-01-21

  Files on the host computer can be accessed from the Gradio interface

  Fixed in: 2.5.0, 41bd3645bdb616e1248b2167ca83636a2653f781