GHSA-jmh7-g254-2cq9
High · 8.2CVSS
8.2
EPSS
—
Published
Mar 1, 2026
CISA due date
—
The record
Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | gradio | 0 | 6.6.0 |
Related vulnerabilities
- CVE-2026-28416 Gradio is an open-source Python package designed for quick prototyping. Same vulnerability
- GHSA-pfjf-5gxr-995x Gradio has an Open Redirect in its OAuth Flow Also affects gradio
- GHSA-39mp-8hj3-5c49 Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+ Also affects gradio
- GHSA-h3h8-3v2v-rg7m Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret Also affects gradio
- CVE-2026-28414 Gradio is an open-source Python package designed for quick prototyping. Also affects gradio
- CVE-2026-28415 Gradio is an open-source Python package designed for quick prototyping. Also affects gradio
- CVE-2026-27167 Gradio is an open-source Python package designed for quick prototyping. Also affects gradio
- CVE-2025-5320 A vulnerability classified as problematic has been found in gradio-app gradio up to… Also affects gradio