CVE-2026-48545
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across all users in the reverse proxy endpoint. Attackers controlling any HF Space can return a parent-domain cookie that the shared client stores and automatically replays into all subsequent proxy requests to other legitimate Spaces, affecting all users of the same Gradio deployment.
Risk Assessment
The risk involves the possibility of cross-Space session fixation attacks, which could lead to session hijacking and unauthorized access to data across different HF Spaces.
Recommendation
It is recommended to immediately upgrade Gradio to version 6.15.0 or later, which fixes this vulnerability by isolating the HTTP client per user.
Other vulnerabilities in Gradio
See all- CVE-2026-59806High
A vulnerability in Gradio before version 6.20.0 allows open redirect and server-side request forgery (SSRF) via unvalidated URLs in the file_fetch() function at the /gradio_api/file= endpoint. Attackers can craft a malicious FileData response to access internal endpoints such as cloud metadata services to steal sensitive credentials, including EC2 IAM role credentials.
- CVE-2026-49119High
A path traversal vulnerability in the FileExplorer component of Gradio before version 6.16.0 allows unauthenticated attackers to read files outside the configured root directory. Attackers can use traversal sequences or absolute paths that cause os.path.join to discard the root_dir prefix.
- CVE-2026-10783Low
A security flaw in gradio-app gradio 6.14.0 affects the save_audio_to_cache function of the Audio Cache Key Handler component. Manipulation leads to use of weak hash. The attack requires local access, is difficult to exploit, but the exploit is publicly available.
- CVE-2023-34239High
Gradio is an open-source Python library used to build machine learning and data science applications. Due to a lack of path filtering, Gradio does not properly restrict file access to users and does not properly restrict what URLs are proxied. These issues have been addressed in version 3.34.0.
Original NVD description (English source)
Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across all users in the reverse proxy endpoint. Attackers controlling any HF Space can return a parent-domain cookie that the shared client stores and automatically replays into all subsequent proxy requests to other legitimate Spaces, affecting all users of the same Gradio deployment.