{"data":{"id":"e9c1f7a6-7d34-413c-ad38-49f238649dbd","title":"CVE-2024-47084: Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin…","summary":"CVE-2024-47084 affects Gradio, an open-source Python package for quick prototyping. The Gradio server fails to validate the request origin when a cookie is present, so a website an attacker controls can send unauthorized requests to a local Gradio server. An attacker could upload files, steal authentication tokens and access user data if a victim visits the malicious site while logged into Gradio. The issue affects users who deployed Gradio locally with basic authentication.","solution":"Upgrade to gradio>4.44. As a workaround, manually enforce stricter CORS origin validation by modifying the CustomCORSMiddleware class in the local Gradio server code, bypassing the condition that skips CORS validation for requests containing cookies.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-47084","publishedAt":"2024-10-11T02:15:10.263Z","cveId":"CVE-2024-47084","cweIds":["CWE-285"],"cvssScore":"8.3","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@< 4.44.0 (fixed: 4.44.0)"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Gradio CORS origin validation flaw allows cross-site requests","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00528,"epssCheckedAt":"2026-11-04T18:09:14.876Z","kevDateAdded":null,"advisoryAliases":["GHSA-3c67-5hwx-f6wx"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:07.211Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-09-10T21:46:23.568Z","daysToFix":-31,"fixCheckedAt":"2026-10-29T21:45:28.029Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"gradio","fixedVersion":"4.44.0","matchedVersion":"4.44.0","fixReleasedAt":"2024-09-10T21:46:23.568Z","daysToFix":-31,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:27.879Z"}]}}