CVE-2026-48545: Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Spa

Gradio versions before 6.15.0 have a cookie injection vulnerability that lets attackers perform session fixation (tricking a system into using a fake session ID) across multiple user spaces. An attacker controlling one Gradio Space can inject a cookie into a shared HTTP client (a tool that sends web requests) that automatically gets sent to all other legitimate Spaces, affecting every user on that Gradio deployment.