PYSEC-2026-1413 Server-Side Request Forgery in gradio

A Server-Side Request Forgery SSRF vulnerability exists in the gradio-app/gradio and was discovered in version 4.21.0, specifically within the /queue/join endpoint and the saveurltocache function. The vulnerability arises when the path value, obtained from the user and expected to be a URL, is us...

PT-2024-32450

Name of the Vulnerable Software and Affected Versions Gradio versions prior to 5 Description This issue relates to Server-Side Request Forgery SSRF in the "/queue/join" endpoint. Gradio’s async save url to cache function allows attackers to force the Gradio server to send HTTP requests to...