AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

GradioGHSA-rvfh-h6c7-fc3c

Gradio allows credential leakage on Windows

Gradio

CVE-2024-34510 · Published May 5, 2024 · updated Jun 17, 2025

High7.5
Fix: upgrade to 4.20.0 or later
GitHub advisory

Gradio before 4.20 allows credential leakage on Windows.

Affected versions

PackageAffectedFixed in
gradio
PyPI
< 4.20.04.20.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-116
Also known as
CVE-2024-34510, PYSEC-2024-255

More Gradio advisories

All Gradio
High 8.6Jun 6, 2024Server-Side Request Forgery in gradioCVE-2024-4325no fix yetCritical 9.1Jun 4, 2024Gradio: command injectionCVE-2024-4253fixed in 4.29.0Medium 4.3May 21, 2024Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading filesCVE-2024-1727fixed in 4.19.2Medium 6.5May 5, 2024Gradio's Component Server does not properly consider` _is_server_fn` for functionsCVE-2024-34511fixed in 4.13.0High 7.5Apr 16, 2024gradio vulnerable to Path TraversalCVE-2024-1561fixed in 4.13.0Medium 6.5Apr 16, 2024gradio Server-Side Request Forgery vulnerabilityCVE-2024-1183fixed in 4.10.0