PyPI: gradio

CVE-2024-4325

Safety vulnerability ID: SFTY-20240606-37135

Safety legacy ID: pyup.io-71888

A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.

PythonPyPINVDNVDGitHubGHSA
Created at: Jul 5, 2026Updated at: Jul 5, 2026

Overview

Server-Side Request Forgery in gradio

Advisory

A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.

Affected Package

Affecting gradio package, versions<=4.36.0

Also affects

---

How to Fix

Upgradegradioto4.36.1or higher.

Mitigation and Workarounds

---

Vulnerable Functions

Functions linked to known vulnerabilities.

Vulnerable function data is available for Enterprise customers

Book a call with us to see Safety in action.

References

Safety

Verified by Safety

Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.

Learn more