AI agent vulnerability · Gradio

CVE-2024-39236: Withdrawn Advisory: Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py

criticalCVSS 3.1 9.8GHSA-9v2f-6vcg-3hgv

This advisory was withdrawn on Oct 17, 2025. The publisher no longer considers it a valid vulnerability.

Withdrawn Advisory This advisory has been withdrawn because the it only affects a user who runs specifically crafted code that happens to use gradio library. More information can be found here. Original Description Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/componentmeta.py. This vulnerability is triggered via a crafted input.

Published Jul 1, 2024 · Updated Jun 5, 2026

Affected packages

Gradio

Ecosystem: PyPI
Affected: = 4.36.1
Fixed in: No patched version yet
Check: pip show Gradio

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Withdrawn Advisory

This advisory has been withdrawn because the it only affects a user who runs specifically crafted code that happens to use gradio library. More information can be found here.

Original Description

Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is triggered via a crafted input.

Credited to kmulka-bloomberg.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Gradio vulnerabilities

All Gradio entries