Suggestions search

All statuses

Filter by:

With package: python314Packages.gradio-client

Found 2 matching suggestions

View:

Compact

Detailed

Untriaged

Permalink CVE-2026-59806

4.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): High (H)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): High (H)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 week, 1 day ago Activity log

Created suggestion 1 week, 1 day ago

Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint

Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URLs or perform client-side SSRF by supplying unvalidated HTTP/HTTPS URLs to the file_fetch() function in the /gradio_api/file= endpoint. Attackers can craft a malicious FileData response targeting internal endpoints such as cloud metadata services to retrieve sensitive credentials including EC2 IAM role credentials.

References

Researcher Disclosure technical-descriptionexploit
Release Notes release-notes
Fix PR issue-tracking
Fix Commit patch
https://www.vulncheck.com/advisories/gradio-open-redirect-and-ssrf-via-gradio-a… third-party-advisory

Affected products

gradio

<6.20.0

Matching in nixpkgs

pkgs.python313Packages.gradio

Python library for easily interacting with trained machine learning models

nixos-unstable 6.9.0
- nixpkgs-unstable 6.9.0
- nixos-unstable-small 6.9.0
nixos-26.05 6.9.0
- nixos-26.05-small 6.9.0
- nixpkgs-26.05-darwin 6.9.0

pkgs.python314Packages.gradio

Python library for easily interacting with trained machine learning models

nixos-unstable 6.9.0
- nixpkgs-unstable 6.9.0
- nixos-unstable-small 6.9.0
nixos-26.05 6.9.0
- nixos-26.05-small 6.9.0
- nixpkgs-26.05-darwin 6.9.0

pkgs.python313Packages.gradio-pdf

Python library for easily interacting with trained machine learning models

nixos-unstable 0.0.23
- nixpkgs-unstable 0.0.23
- nixos-unstable-small 0.0.23
nixos-26.05 0.0.23
- nixos-26.05-small 0.0.23
- nixpkgs-26.05-darwin 0.0.23

pkgs.python314Packages.gradio-pdf

Python library for easily interacting with trained machine learning models

nixos-unstable 0.0.23
- nixpkgs-unstable 0.0.23
- nixos-unstable-small 0.0.23
nixos-26.05 0.0.23
- nixos-26.05-small 0.0.23
- nixpkgs-26.05-darwin 0.0.23

pkgs.pkgsRocm.python3Packages.gradio

Python library for easily interacting with trained machine learning models

nixos-unstable 6.9.0
- nixpkgs-unstable 6.9.0
- nixos-unstable-small 6.9.0
nixos-26.05 6.9.0
- nixos-26.05-small 6.9.0
- nixpkgs-26.05-darwin 6.9.0

pkgs.python313Packages.gradio-client

Lightweight library to use any Gradio app as an API

nixos-unstable 2.3.0
- nixpkgs-unstable 2.3.0
- nixos-unstable-small 2.3.0
nixos-26.05 2.3.0
- nixos-26.05-small 2.3.0
- nixpkgs-26.05-darwin 2.3.0

pkgs.python314Packages.gradio-client

Lightweight library to use any Gradio app as an API

nixos-unstable 2.3.0
- nixpkgs-unstable 2.3.0
- nixos-unstable-small 2.3.0
nixos-26.05 2.3.0
- nixos-26.05-small 2.3.0
- nixpkgs-26.05-darwin 2.3.0

pkgs.pkgsRocm.python3Packages.gradio-pdf

Python library for easily interacting with trained machine learning models

nixos-unstable 0.0.23
- nixpkgs-unstable 0.0.23
- nixos-unstable-small 0.0.23
nixos-26.05 0.0.23
- nixos-26.05-small 0.0.23
- nixpkgs-26.05-darwin 0.0.23

pkgs.pkgsRocm.python3Packages.gradio-client

Lightweight library to use any Gradio app as an API

nixos-unstable 2.3.0
- nixpkgs-unstable 2.3.0
- nixos-unstable-small 2.3.0
nixos-26.05 2.3.0
- nixos-26.05-small 2.3.0
- nixpkgs-26.05-darwin 2.3.0

Package maintainers

@pbsds Peder Bergebakken Sundt <pbsds@hotmail.com>

Untriaged

Permalink CVE-2026-49119

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 2 weeks, 1 day ago Activity log

Created suggestion 2 weeks, 1 day ago

Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()

Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape the configured root directory by supplying path segments containing directory traversal sequences or absolute paths. Attackers can provide crafted path segments that cause os.path.join to discard the root_dir prefix entirely, resulting in arbitrary file read or exposure of sensitive files outside the intended directory.