GitHub Advisoryadvisory · PyPI

GHSA-wmjh-cpqj-4v6x Gradio CORS Origin Validation Bypass Vulnerability

LOW Published 2025-05-29 Modified 2025-06-05 Official page ↗
Aliases
CVE-2025-5320
Ecosystem
PyPI
Packages
gradio
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-345
Reviewed
2025-06-05

Affected packages

• PyPI gradio: >= 5.0.0, <= 5.29.1 (no fix yet)

Description

A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function is_valid_origin of the component CORS Handler. The manipulation of the argument localhost_aliases leads to origin validation error. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Related

Alias · CVE (1)

  • CVE-2025-5320 A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. vulnerability

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References