Vulnerability · Published Jun 22, 2024 · Assigned by @huntr_ai
CVE-2024-4940Open Redirect in gradio-app/gradio
Medium 5.4
In plain English
A medium-severity open redirect in gradio-app/gradio from gradio-app. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | gradio | no fix listed | GHSA-g6c9-f4xm-9j4x |
| PyPI | gradio | no fix listed | PYSEC-2026-1414 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| gradio-app | gradio-app/gradio | unspecified – through latest |
Weakness: CWE-601 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N