AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

GradioPYSEC-2024-274

Gradio: code injection

Gradio

CVE-2024-39236 · Published Jul 1, 2024 · updated May 21, 2026

Critical9.8
No fix yet
Source advisory

Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is triggered via a crafted input. NOTE: the supplier disputes this because the report is about a user attacking himself.

Affected versions

PackageAffectedFixed in
gradio
PyPI
<= 4.36.1No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
the CVSS score
Also known as
CVE-2024-39236, GHSA-9v2f-6vcg-3hgv

More Gradio advisories

All Gradio
Medium 5.4Jun 22, 2024Open redirect in gradioCVE-2024-4940no fix yetHigh 7.5Jun 6, 2024Local file inclusion in gradioCVE-2024-4941fixed in 4.31.3High 8.6Jun 6, 2024Server-Side Request Forgery in gradioCVE-2024-4325no fix yetCritical 9.1Jun 4, 2024Gradio: command injectionCVE-2024-4253fixed in 4.29.0Medium 4.3May 21, 2024Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading filesCVE-2024-1727fixed in 4.19.2Medium 6.5May 5, 2024Gradio's Component Server does not properly consider` _is_server_fn` for functionsCVE-2024-34511fixed in 4.13.0