PYSEC-2026-1409 Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading files

Impact This CVE covers the ability of 3rd party websites to access routes and upload files to users running Gradio applications locally. For example, the malicious owners of www.dontvisitme.com could put a script on their website that uploads a large file to http://localhost:7860/upload and anyon...

academic-chatgpt (>=0.3.0 <=0.4.1), agentverse (>=0.1.5 <=0.1.8.1) +121 more potentially affected by CVE-2024-1727 via gradio (>=1.7.7 <=4.19.1)

gradio PYPI version =1.7.7, =0.3.0, =0.1.5, =0.0.17, =0.0.2, =0.8.11, =0.7.0.dev134, =0.1.0rc1, =0.0.0, =0.6.14, =0.7.63 and more Source cves: CVE-2024-1727 Source advisory: OSV:GHSA-48CQ-79QQ-6F7X...