# Gradio Project Gradio


- [CVE-2024-39236](https://insights.sbomify.com/CVE-2024-39236/): Withdrawn Advisory: Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py (critical 9.8)
- [CVE-2023-6572](https://insights.sbomify.com/CVE-2023-6572/): Command Injection in gradio-app/gradio (critical 9.6)
- [CVE-2022-24770](https://insights.sbomify.com/CVE-2022-24770/): Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging (high 8.8)
- [CVE-2026-49119](https://insights.sbomify.com/CVE-2026-49119/): Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess() (high 8.7)
- [CVE-2025-23042](https://insights.sbomify.com/CVE-2025-23042/): Gradio Blocked Path ACL Bypass Vulnerability (high 8.7)
- [CVE-2024-4325](https://insights.sbomify.com/CVE-2024-4325/): Server-Side Request Forgery (SSRF) in gradio-app/gradio (high 8.6)
- [CVE-2024-1540](https://insights.sbomify.com/CVE-2024-1540/): Command Injection in gradio-app/gradio via deploy+test-visual.yml workflow (high 8.6)
- [CVE-2026-28416](https://insights.sbomify.com/CVE-2026-28416/): Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing (high 8.2)
- [CVE-2024-10648](https://insights.sbomify.com/CVE-2024-10648/): Path Traversal in gradio-app/gradio (high 8.2)
- [CVE-2024-47871](https://insights.sbomify.com/CVE-2024-47871/): Insecure communication between the FRP client and server in Gradio (high 8.2)
- [CVE-2021-43831](https://insights.sbomify.com/CVE-2021-43831/): Files on the host computer can be accessed from the Gradio interface (high 7.7)
- [CVE-2026-48545](https://insights.sbomify.com/CVE-2026-48545/): Gradio < 6.15.0 Cookie Injection via Shared Proxy Client (high 7.6)

---
From sbomify Insights: https://insights.sbomify.com/products/gradio_project/gradio/