CVE-2026-63766_exploit

CVE-2026-63766 — GPT-SoVITS Unauthenticated OS Command Injection Unauthenticated remote code execution in GPT-SoVITS's Gradio web UI webui.py. The audio-processing helpers openasr, openslice, opendenoise, openuvr5 interpolate unsanitised Gradio textbox path values straight into shell commands run...

Gradio - Absolute Path Traversal

Gradio 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server. id: CVE-2026-28414 info: name: Gradio - Absolute Path Traversal author: 0xAkoko severity:...

Gradio Hugging Face - Local File Inclusion

Gradio LFI when auth is not enabled, affects versions 4.0 - 4.10, also works against Gradio 3.33 id: CVE-2023-51449 info: name: Gradio Hugging Face - Local File Inclusion author: nvn1729 severity: high description: | Gradio LFI when auth is not enabled, affects versions 4.0 - 4.10, also works...

Gradio - Open Redirect

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting XSS, Server-Side Request Forgery SSRF, amongst others. This...

Gradio - Server-Side Request Forgery

A Server-Side Request Forgery SSRF vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the /queue/join endpoint and the saveurltocache function. The vulnerability arises when the path value, obtained from the user and expected to be a URL, is used to make an HTTP...

Gradio 4.3-4.12 - Local File Read

Local file read by calling arbitrary methods of Components class between Gradio versions 4.3-4.12 id: CVE-2024-1561 info: name: Gradio 4.3-4.12 - Local File Read author: nvn1729,Diablo severity: high description: | Local file read by calling arbitrary methods of Components class between Gradio...

Gradio < 2.5.0 - Arbitrary File Read

Files on the host computer can be accessed from the Gradio interface id: CVE-2021-43831 info: name: Gradio 2.5.0 - Arbitrary File Read author: isacaya severity: high description: | Files on the host computer can be accessed from the Gradio interface impact: | An attacker would be able to view the...

Gradio - Open Redirect

Gradio allows an open redirect bypass via URL encoding, enabling attackers to redirect users to malicious sites. This can lead to phishing attacks and loss of trust in the application. id: CVE-2024-8021 info: name: Gradio - Open Redirect author: DhiyaneshDK severity: medium description: | Gradio...

Gradio > 4.19.1 UploadButton - Path Traversal

gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. id: CVE-2024-1728 info: name: Gradio 4.19.1 UploadButton - Path Traversal author: isacaya severity: high description: | gradio-app/gradio is...

Gradio - Server Side Request Forgery

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

gha-lab-40e23db109

轻松构建 & 分享 令人愉快的机器学习程序 官网 | 文档 | 指南 | 开始 | 样例 | English Gradio: 用Python构建机器学习网页APP Gradio是一个开源的Python库，用于构建演示机器学习或数据科学，以及web应用程序。 使用Gradio，您可以基于您的机器学习模型或数据科学工作流快速创建一个漂亮的用户界面，让用户可以”尝试“拖放他们自己的图像、粘贴文本、录制他们自己的声音，并通过浏览器与您的演示程序进行交互。 Gradio适用于: 向客户/合伙人/用户/学生演示 您的机器学习模型。 通过自动共享链接快速部署 您的模型，并获得模型性能反馈。...

gha-lab-ee08e207a8

轻松构建 & 分享 令人愉快的机器学习程序 官网 | 文档 | 指南 | 开始 | 样例 | English Gradio: 用Python构建机器学习网页APP Gradio是一个开源的Python库，用于构建演示机器学习或数据科学，以及web应用程序。 使用Gradio，您可以基于您的机器学习模型或数据科学工作流快速创建一个漂亮的用户界面，让用户可以”尝试“拖放他们自己的图像、粘贴文本、录制他们自己的声音，并通过浏览器与您的演示程序进行交互。 Gradio适用于: 向客户/合伙人/用户/学生演示 您的机器学习模型。 通过自动共享链接快速部署 您的模型，并获得模型性能反馈。...

Nuclei-Template-CVE-2024-1561

CVE-2024-1561 Nuclei Template This Nuclei template is designed to detect the Gradio CVE-2024-1561 vulnerability in web applications. Gradio is a Python library for creating customizable UI components around machine learning models. This vulnerability may allow attackers to read files from the...

CVE-2024-47167-Environment-Setup

Components: 1. gradiocontainer: 内部HTTPサーバーをポート5678でホストする 2. targetinternalserver: 脆弱性のあるバージョンのgradio（4.40.0）を使用してPythonアプリを起動する...

gha-lab-8e9316151c

轻松构建 & 分享 令人愉快的机器学习程序 官网 | 文档 | 指南 | 开始 | 样例 | English Gradio: 用Python构建机器学习网页APP Gradio是一个开源的Python库，用于构建演示机器学习或数据科学，以及web应用程序。 使用Gradio，您可以基于您的机器学习模型或数据科学工作流快速创建一个漂亮的用户界面，让用户可以”尝试“拖放他们自己的图像、粘贴文本、录制他们自己的声音，并通过浏览器与您的演示程序进行交互。 Gradio适用于: 向客户/合伙人/用户/学生演示 您的机器学习模型。 通过自动共享链接快速部署 您的模型，并获得模型性能反馈。...

CVE-2024-1561

CVE-2024-1561 - Gradio Arbitrary File Read CVE-2024-1561 is an arbitrary file read vulnerability affecting Gradio versions prior to 4.13.0. Gradio is a popular Python framework used to quickly build web interfaces for machine learning models and AI applications. The vulnerability exists because t...

gha-lab-6255f5fc33

轻松构建 & 分享 令人愉快的机器学习程序 官网 | 文档 | 指南 | 开始 | 样例 | English Gradio: 用Python构建机器学习网页APP Gradio是一个开源的Python库，用于构建演示机器学习或数据科学，以及web应用程序。 使用Gradio，您可以基于您的机器学习模型或数据科学工作流快速创建一个漂亮的用户界面，让用户可以”尝试“拖放他们自己的图像、粘贴文本、录制他们自己的声音，并通过浏览器与您的演示程序进行交互。 Gradio适用于: 向客户/合伙人/用户/学生演示 您的机器学习模型。 通过自动共享链接快速部署 您的模型，并获得模型性能反馈。...

CVE-2024-1561

CVE-2024-1561 PoC Script This is a Proof of Concept PoC script for CVE-2024-1561. Check the full writeup for the CVE here: https://huntr.com/bounties/4acf584e-2fe8-490e-878d-2d9bf2698338 Affected Version: Gradio 4.12.0 This was fixed in this PR https://github.com/gradio-app/gradio/pull/6884 and w...

SUSE CVE-2026-28416

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery SSRF vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victim application uses...

CVE-2026-82637

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...