AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

GradioGHSA-gqvf-3hgp-5hxv

Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Gradio

CVE-2023-6572 · Published Dec 14, 2023 · updated Sep 10, 2026

Critical9.6
Fix: upgrade to 4.14.0 or later
GitHub advisory

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository gradio-app/gradio prior to main.

Affected versions

PackageAffectedFixed in
gradio
PyPI
< 4.14.04.14.0
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-200, CWE-77
Also known as
CVE-2023-6572, PYSEC-2023-255

More Gradio advisories

All Gradio
Medium 6.5Apr 16, 2024gradio Server-Side Request Forgery vulnerabilityCVE-2024-1183fixed in 4.10.0High 7.3Mar 27, 2024gradio Server-Side Request Forgery vulnerabilityCVE-2024-2206fixed in 4.18.0Medium 5.9Feb 22, 2024Gradio apps vulnerable to timing attacks to guess passwordCVE-2024-1729fixed in 4.19.2High 7.5Feb 6, 2024Gradio Path Traversal vulnerabilityCVE-2024-0964fixed in 4.9.0High 8.6Dec 21, 2023Gradio makes the `/file` secure against file traversal and server-side request forgery attacksCVE-2023-51449fixed in 4.11.0Medium 4.8Sep 16, 2023Gradio arbitrary file upload vulnerabilityCVE-2023-41626no fix yet