Vulnerability PYSEC-2026-1423
Low Risk
LOW RISK
CVSS Score: 3.7
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
2 months ago
July 07, 2026 at 04:02 PM UTC
Gradio CORS Origin Validation Bypass Vulnerability
5.0.0 - 5.29.1
5.0.0 - 5.29.1
Summary
Gradio CORS Origin Validation Bypass Vulnerability
Details
A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function is_valid_origin of the component CORS Handler. The manipulation of the argument localhost_aliases leads to origin validation error. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
2 months ago
Gradio DOS in multipart boundry while uploading the file
0.1.0 - 5.22.0 PYSEC-2026-1410
0.1.0 - 5.22.0 PYSEC-2026-1410
Medium Risk
2 months ago
Gradio Vulnerable to Open Redirect
0.1.0 - 4.37.2 PYSEC-2026-1411
0.1.0 - 4.37.2 PYSEC-2026-1411
Medium Risk
2 months ago
Gradio Path Traversal vulnerability
0.1.0 - 5.0.1 PYSEC-2026-1418
0.1.0 - 5.0.1 PYSEC-2026-1418
High Risk
2 months ago
Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb
4.0.0 - 5.0.0b1 PYSEC-2026-1412
4.0.0 - 5.0.0b1 PYSEC-2026-1412
High Risk
2 months ago
Gradio Vulnerable to Arbitrary File Deletion
4.0.0 - 5.0.0b1 PYSEC-2026-1417
4.0.0 - 5.0.0b1 PYSEC-2026-1417
Impacted packages
Timeline
Published
2 months ago
July 07, 2026 at 04:02 PM UTC
Last Modified
2 months ago
July 07, 2026 at 05:47 PM UTC