AI agent vulnerability · Gradio

CVE-2024-34510: Gradio allows credential leakage on Windows

highCVSS 3.1 7.5GHSA-rvfh-h6c7-fc3c

Gradio before 4.20 allows credential leakage on Windows.

Published May 5, 2024 · Updated Jun 17, 2025

Affected packages

gradio

Ecosystem: PyPI
Affected: < 4.20.0
Fixed in: 4.20.0
Check: pip show gradio

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Gradio before 4.20 allows credential leakage on Windows.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-34510
https://github.com/gradio-app/gradio
https://www.gradio.app/changelog#4-20-0
https://github.com/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2024-255.yaml
https://github.com/advisories/GHSA-rvfh-h6c7-fc3c

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Gradio vulnerabilities

All Gradio entries

CVE-2026-49119
Gradio FileExplorer preprocess path traversal allows files outside root_dir to reach callbacks
high7.5Jul 1, 2026
CVE-2026-10783
Gradio: Audio cache key ignores metadata when saving numpy audio outputs
low2.5Jun 4, 2026
CVE-2026-48545
Gradio contains a cookie injection vulnerability
high6.8May 27, 2026
CVE-2026-27167
Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret
lowMar 1, 2026
CVE-2026-28414
Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+
high7.5Mar 1, 2026
CVE-2026-28415
Gradio has an Open Redirect in its OAuth Flow
medium4.3Mar 1, 2026