GHSA-wmjh-cpqj-4v6x

Suggest an improvement
Source
https://github.com/advisories/GHSA-wmjh-cpqj-4v6x
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-wmjh-cpqj-4v6x/GHSA-wmjh-cpqj-4v6x.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-wmjh-cpqj-4v6x
Aliases
Published
2025-05-29T15:31:09Z
Modified
2026-07-07T17:56:26Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
  • 2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Gradio CORS Origin Validation Bypass Vulnerability
Details

A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function is_valid_origin of the component CORS Handler. The manipulation of the argument localhost_aliases leads to origin validation error. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific 
{
    "cwe_ids":  [
        "CWE-345"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-06-05T00:22:23Z",
    "nvd_published_at":  "2025-05-29T14:15:38Z",
    "severity":  "LOW"
}
References

Affected packages

PyPI / gradio

Package

Name
gradio
View open source insights on deps.dev
Purl
pkg:pypi/gradio

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Last Affected
5.29.1

Affected versions

5.*
5.0.0
5.0.1
5.0.2
5.1.0
5.3.0
5.4.0
5.5.0
5.6.0
5.7.0
5.7.1
5.8.0
5.9.0
5.9.1
5.10.0
5.11.0
5.12.0
5.13.0
5.13.1
5.13.2
5.14.0
5.15.0
5.16.0
5.16.1
5.16.2
5.17.0
5.17.1
5.18.0
5.19.0
5.20.0
5.20.1
5.21.0
5.22.0
5.23.0
5.23.1
5.23.2
5.23.3
5.24.0
5.25.0
5.25.1
5.25.2
5.26.0
5.27.0
5.27.1
5.28.0
5.29.0
5.29.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-wmjh-cpqj-4v6x/GHSA-wmjh-cpqj-4v6x.json"