Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading files

ImpactThis CVE covers the ability of 3rd party websites to access routes and upload files to users running Gradio applications locally. For example, the malicious owners of www.dontvisitme.com could put a script on their website that uploads a large file to http://localhost:7860/upload and anyone...

fastmonai (>=0.3.6, <=0.8.3), melotts-krqnf (0.1.2) +3 more potentially affected by CVE-2024-1727 via gradio (3.36.1)

gradio PYPI version 3.36.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - fastmonai =0.3.6, =2.1.0, =0.0.4, =0.0.5 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

apillava (0.1.0), find-anything (>=1.2.0, <=1.3.0) +4 more potentially affected by CVE-2024-1727 via gradio (3.35.2)

gradio PYPI version 3.35.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - apillava 0.1.0 - find-anything =1.2.0, =0.2.16, =1.0.2, =0.1.1, =0.1.2 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

langs-vall (>=0.0.1, <=0.0.18) potentially affected by CVE-2024-1727 via gradio (3.47.1)

gradio PYPI version 3.47.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - langs-vall =0.0.1, =0.0.18 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

academic-chatgpt (>=0.3.0, <=0.4.1), agentverse (>=0.1.5, <=0.1.8) +46 more potentially affected by CVE-2024-1727 via gradio (3.50.2)

gradio PYPI version 3.50.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - academic-chatgpt =0.3.0, =0.1.5, =0.0.4, =0.8.11, =0.1.0, =0.1.3, =1.1.0, =1.2.1 and more Source cves: CVE-2024-1727 Source advisory:...

llmtuner (0.2.0), prompt2model (>=0.0.0a0, <=0.1.0) potentially affected by CVE-2024-1727 via gradio (3.38.0)

gradio PYPI version 3.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - llmtuner 0.2.0 - prompt2model =0.0.0a0, =0.1.0 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

agentx (>=0.0.17, <=0.0.27), chat-with-mlx (>=0.1.0, <=0.1.5) +18 more potentially affected by CVE-2024-1727 via gradio (>=4.0.0b15, <=4.19.1)

gradio PYPI version =4.0.0b15, =0.0.17, =0.1.0, =0.1.2, =1.0.0, =0.0.5, =1.2.1.post4, =0.0.0.1, =0.0.1, =0.1.0, =1.0.1.1, =1.0.2.17 and more Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

musicaiz (>=0.0.1, <=0.0.2) potentially affected by CVE-2024-1727 via gradio (3.0.15)

gradio PYPI version 3.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - musicaiz =0.0.1, =0.0.2 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

picsimsearch (>=0.1.0, <=0.1.2) potentially affected by CVE-2024-1727 via gradio (3.40.1)

gradio PYPI version 3.40.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - picsimsearch =0.1.0, =0.1.2 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

customintents (>=0.7.3, <=0.7.6) potentially affected by CVE-2024-1727 via gradio (3.16.1)

gradio PYPI version 3.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - customintents =0.7.3, =0.7.6 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

pynami (>=0.0.1, <=0.0.2) potentially affected by CVE-2024-1727 via gradio (3.17.0)

gradio PYPI version 3.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - pynami =0.0.1, =0.0.2 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

cosyvoice-package (0.0.2), matcha-tts (>=0.0.7.1, <=0.0.7.2) +1 more potentially affected by CVE-2024-1727 via gradio (3.43.2)

gradio PYPI version 3.43.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cosyvoice-package 0.0.2 - matcha-tts =0.0.7.1, =0.0.7.2 - matcha-tts-package 0.0.1 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

trubrics (>=1.1.0, <=1.1.1) potentially affected by CVE-2024-1727 via gradio (3.8.1)

gradio PYPI version 3.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - trubrics =1.1.0, =1.1.1 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

copra-theorem-prover (>=1.0.0, <=1.1.11), openvoiceplus (>=0.0.1, <=0.0.2) +1 more potentially affected by CVE-2024-1727 via gradio (3.48.0)

gradio PYPI version 3.48.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - copra-theorem-prover =1.0.0, =0.0.1, =1.0.0, =1.1.6 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

torchflare (0.2.4) potentially affected by CVE-2024-1727 via gradio (2.2.13)

gradio PYPI version 2.2.13 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - torchflare 0.2.4 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

customintents (>=0.8.0, <=1.0.0) potentially affected by CVE-2024-1727 via gradio (3.16.2)

gradio PYPI version 3.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - customintents =0.8.0, =1.0.0 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

draggan (1.1.6), fast-tts (0.0.3) +2 more potentially affected by CVE-2024-1727 via gradio (3.34.0)

gradio PYPI version 3.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - draggan 1.1.6 - fast-tts 0.0.3 - kaggle-deps 0.1.0 - oobabot-plugin =0.2.0, =0.2.2 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

querytograph (>=0.0.1, <=0.0.5), tumourkit (>=0.6.0, <=0.10.1) potentially affected by CVE-2024-1727 via gradio (3.26.0)

gradio PYPI version 3.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - querytograph =0.0.1, =0.6.0, =0.10.1 Source cves: CVE-2024-1727 Source advisory: OSV:PYSEC-2026-1409...

oobabot-plugin (0.2.3) potentially affected by CVE-2024-1727 via gradio (3.33.1)

gradio PYPI version 3.33.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - oobabot-plugin 0.2.3 Source cves: CVE-2024-1727 Source advisory: OSV:GHSA-48CQ-79QQ-6F7X...

picsimsearch (>=0.1.0, <=0.1.2) potentially affected by CVE-2024-1727 via gradio (3.40.1)

gradio PYPI version 3.40.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - picsimsearch =0.1.0, =0.1.2 Source cves: CVE-2024-1727 Source advisory: OSV:GHSA-48CQ-79QQ-6F7X...