AI agent vulnerability · Gradio

CVE-2026-10783: Gradio: Audio cache key ignores metadata when saving numpy audio outputs

lowCVSS 4.0 1.1 · 3.1 2.5GHSA-6655-8ph2-63j3

A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function saveaudiotocache of the component Audio Cache Key Handler. Performing a manipulation results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high complexity. It is indicated that the exploitability is difficult.

Published Jun 4, 2026 · Updated Jul 14, 2026

Affected packages

gradio

Ecosystem: PyPI
Affected: < 6.15.1
Fixed in: 6.15.1
Check: pip show gradio

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Performing a manipulation results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The patch is named 13394. To fix this issue, it is recommended to deploy a patch.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Gradio vulnerabilities

All Gradio entries