CVE-2025-5320

What it actually does

The flaw is an authorization/CORS origin validation bypass in Gradio's CORS handler, specifically in logic associated with is_valid_origin and localhost_aliases. If an application incorrectly trusts requests because an attacker-controlled Origin value is treated as a valid localhost alias, a remote unauthenticated attacker may be able to perform cross-origin actions that should have been blocked by the browser's same-origin policy. The reported impact is limited to low integrity impact: the attacker may be able to trigger or influence permitted application actions, but the CVSS data does not indicate confidentiality loss, service disruption, or direct code execution. The provided affected-product metadata also lists Ubuntu gst-plugins-base1.0 packages, which appears inconsistent with the Gradio CORS description; teams should validate which package advisory applies in their vulnerability management source before closing or suppressing findings.

Why it matters to the business

For organizations exposing Gradio-based applications, especially internal ML demos, model interfaces, or admin-like tools reachable from browsers, this issue could allow a malicious website or remote attacker to cause unauthorized cross-origin interactions with the application under narrow conditions. The severity is relatively low, exploitation complexity is high, EPSS is low, and it is not listed in CISA KEV or ransomware-associated reporting, but public disclosure means internet-exposed or sensitive Gradio deployments should still be reviewed and updated. If the Ubuntu gst-plugins-base1.0 package mapping is present in asset scanners, remediation should be handled carefully because the package metadata may represent a separate downstream advisory or a data-mapping inconsistency.

How an attack unfolds

An attacker first identifies an exposed Gradio application or a browser-accessible Gradio endpoint using a vulnerable version. They then craft a malicious web page or direct HTTP requests that supply a manipulated Origin header resembling a trusted localhost alias. If the vulnerable is_valid_origin logic accepts the crafted origin as trusted, the CORS handler may return permissive CORS response headers. From there, the attacker attempts to make browser-mediated requests to application endpoints that would normally reject cross-origin access. Successful exploitation depends on the target deployment's CORS configuration, reachable endpoints, browser behavior, and whether useful state-changing actions are exposed without additional protections. No confirmed KEV exploitation or ransomware use is indicated in the supplied data.

How to fix it

Upgrade Gradio to a version newer than 5.29.1 once a vendor-fixed release is available and verified by the relevant advisory source. Do not rely on CORS as the sole authorization boundary: require server-side authentication and authorization for sensitive endpoints, enforce CSRF protections where browser sessions are used, and restrict allowed origins to explicit trusted domains rather than broad localhost aliases. For deployments that cannot immediately upgrade, place Gradio applications behind an authenticated reverse proxy, disable public exposure, restrict network access, and configure the proxy to reject unexpected Origin headers. If vulnerability management is reporting the listed Ubuntu packages, update gst-plugins-base1.0 to the provided fixed package versions where applicable: Ubuntu 20.04 LTS fixed in 1.16.3-0ubuntu1.2 and Ubuntu 22.04 LTS fixed in 1.20.1-1ubuntu0.1. Because the Gradio description and Ubuntu GStreamer package data appear inconsistent, confirm advisory applicability through OS vendor notices, package changelogs, and scanner plugin details before treating package upgrades as the complete fix for a Gradio deployment.

How to confirm the fix worked

Confirm whether Gradio is present and determine its version using package inventory, application manifests, container images, lockfiles, or runtime checks such as pip show gradio. Verify that no deployed Gradio instance is at or below 5.29.1 unless compensating controls are in place. Test CORS behavior in a non-production-safe manner by sending OPTIONS and standard requests with untrusted Origin values and confirming the application does not return permissive Access-Control-Allow-Origin for unexpected localhost aliases. Validate that sensitive endpoints require server-side authorization regardless of Origin. For Ubuntu package findings, run package version checks and confirm gst-plugins-base1.0 is at least 1.16.3-0ubuntu1.2 on Ubuntu 20.04 LTS or 1.20.1-1ubuntu0.1 on Ubuntu 22.04 LTS, then rescan with the vulnerability scanner that raised the finding.

Typical attack path

1. Identify a Gradio deployment or endpoint running a version at or below 5.29.1, or identify assets flagged by the relevant advisory.
2. Probe CORS behavior using OPTIONS and normal application requests with varied Origin headers such as localhost-style aliases, loopback addresses, or malformed localhost variants.
3. Determine whether the server reflects or authorizes the crafted Origin and returns Access-Control-Allow-Origin and related CORS headers.
4. Host or deliver a malicious page that causes a victim browser to send cross-origin requests to the vulnerable application, or send crafted requests directly where browser CORS behavior is not required.
5. Attempt state-changing or privilege-relevant actions exposed by the application that rely on CORS origin checks as a security boundary.
6. Review responses for evidence that unauthorized actions succeeded or application state was modified.

How to detect it

To assess possible prior exploitation, review application, reverse-proxy, WAF, and load-balancer logs for requests to Gradio endpoints containing suspicious Origin headers that use localhost, loopback, IPv6 loopback, 0.0.0.0, unusual ports, encoded hostnames, or domain names that visually resemble localhost. Pay particular attention to OPTIONS preflight requests followed by POST, PUT, PATCH, DELETE, queue, API, upload, or configuration-related requests from the same source. Look for responses containing Access-Control-Allow-Origin that match unexpected attacker-supplied origins. In browser-mediated attack scenarios, the source IP may be a legitimate user's browser while the Origin header points to an attacker-controlled site, so correlate Origin, Referer, session identifiers, and endpoint activity. Review Gradio application logs for unexpected state changes, file uploads, job submissions, prediction requests, admin/configuration actions, or API calls that occurred shortly after suspicious CORS probes. If Ubuntu package findings are in scope, endpoint forensics should focus on package version exposure rather than a known exploit artifact, as no specific GStreamer exploitation indicators are derivable from the supplied description.

• Origin: http://localhost
• Origin: https://localhost
• Origin: http://127.0.0.1
• Origin: https://127.0.0.1
• Origin: http://0.0.0.0
• Origin: https://0.0.0.0
• Origin: http://[::1]
• Origin: https://[::1]
• Access-Control-Request-Method: POST
• Access-Control-Allow-Origin: http://localhost
• Access-Control-Allow-Origin: http://127.0.0.1
• Access-Control-Allow-Origin: http://0.0.0.0
• Access-Control-Allow-Origin: http://[::1]
• /queue/join
• /queue/data
• /api/predict
• /run/predict
• /upload
• localhost_aliases
• is_valid_origin

What your security team should do

• Prioritize inventory of internet-accessible or broadly reachable Gradio applications and identify versions at or below 5.29.1.
• Treat public Gradio interfaces that expose state-changing actions, model administration, file operations, or privileged workflows as higher priority even though the base score and EPSS are low.
• Apply available Gradio fixes or isolate affected applications behind authentication and network controls until a fixed version is deployed.
• Review CORS allowlists and remove wildcard, reflected, or localhost-alias-based trust where not strictly required.
• Add regression tests that verify untrusted Origin headers do not receive permissive CORS responses.
• Investigate scanner findings that map this issue to Ubuntu gst-plugins-base1.0, because the supplied product metadata conflicts with the Gradio vulnerability description.
• For Ubuntu package remediation workflows, upgrade gst-plugins-base1.0 to the fixed versions listed for the relevant LTS release and verify through vendor advisory references.
• Monitor web and reverse-proxy logs for unusual Origin headers, repeated CORS preflight probing, and requests from external sources attempting localhost-style origins.