{"data":{"id":"65ee0472-fd34-4110-aa97-c3fd325b64c4","title":"CVE-2025-5320: A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function…","summary":"CVE-2025-5320 is a vulnerability classified as problematic in gradio-app gradio up to 5.29.1. It affects the function is_valid_origin of the CORS Handler component, where manipulating the argument localhost_aliases leads to erweiterte Rechte (extended privileges). The attack can be initiated remotely, is rated high in complexity and difficult to exploit, and the exploit has been publicly disclosed. The vendor was contacted early but did not respond.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-5320","publishedAt":"2025-05-29T18:15:38.377Z","cveId":"CVE-2025-5320","cweIds":["CWE-345","CWE-346"],"cvssScore":"3.7","cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@>= 5.0.0, <= 5.29.1"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"gradio-app gradio CORS origin validation flaw allows privilege escalation","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00268,"epssCheckedAt":"2026-11-04T06:10:15.713Z","kevDateAdded":null,"advisoryAliases":["GHSA-wmjh-cpqj-4v6x"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:44.152Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}