AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

GradioGHSA-34rf-p3r3-58x2

Gradio's Component Server does not properly consider` _is_server_fn` for functions

Gradio

CVE-2024-34511 · Published May 5, 2024 · updated Sep 10, 2026

Medium6.5
Fix: upgrade to 4.13.0 or later
GitHub advisory

Component Server in Gradio before 4.13 does not properly consider _is_server_fn for functions.

Affected versions

PackageAffectedFixed in
gradio
PyPI
< 4.13.04.13.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Severity from
GitHub (reviewed advisory)
Also known as
CVE-2024-34511, PYSEC-2026-1407

More Gradio advisories

All Gradio
High 8.6Jun 6, 2024Server-Side Request Forgery in gradioCVE-2024-4325no fix yetCritical 9.1Jun 4, 2024Gradio: command injectionCVE-2024-4253fixed in 4.29.0Medium 4.3May 21, 2024Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading filesCVE-2024-1727fixed in 4.19.2High 7.5May 5, 2024Gradio allows credential leakage on WindowsCVE-2024-34510fixed in 4.20.0High 7.5Apr 16, 2024gradio vulnerable to Path TraversalCVE-2024-1561fixed in 4.13.0Medium 6.5Apr 16, 2024gradio Server-Side Request Forgery vulnerabilityCVE-2024-1183fixed in 4.10.0