MediumVulnerability
CVE-2024-47165: Gradio CORS origin validation accepts null origin on local deployments
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2024-47165
- Published
- Record updated
- Affected
- gradio < 5.0.0
- Fixed in
- 5.0.0
- released October 9, 2024, 2 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
Gradio, an open-source Python package for prototyping, accepts the null origin in CORS validation when deployed locally, because the localhost_aliases variable includes "null". Attackers can use sandboxed iframes or other null-origin sources to make unauthorized requests, potentially stealing authentication tokens or uploaded files, especially where basic authentication is used.
Mitigation
Upgrade to gradio>=5.0. As a workaround, manually remove "null" from the localhost_aliases list in the local Gradio deployment.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- gradioPyPILLM dependency since 2023-03-14 · 11 tracked dependents