CVE-2024-47165

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **CORS origin validation accepting a null origin**. When a Gradio server is deployed locally, the `localhost_aliases` variable includes "null" as a valid origin. This allows attackers to make unauthorized requests from sandboxed iframes or other sources with a null origin, potentially leading to data theft, such as user authentication tokens or uploaded files. This impacts users running Gradio locally, especially those using basic authentication. Users are advised to upgrade to `gradio>=5.0` to address this issue. As a workaround, users can manually modify the `localhost_aliases` list in their local Gradio deployment to exclude "null" as a valid origin. By removing this value, the Gradio server will no longer accept requests from sandboxed iframes or sources with a null origin, mitigating the potential for exploitation.

• CWE-285

• https://github.com/gradio-app/gradio/security/advisories/GHSA-89v2-pqfv-c5r9Third Party Advisory

Published

Oct 10, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-47159In JetBrains YouTrack before 2024.3.44799 user without appro…4.3
• CVE-2024-4716A vulnerability has been found in Campcodes Complete Web-Bas…6.1
• CVE-2024-47160In JetBrains YouTrack before 2024.3.44799 access to global a…5.3
• CVE-2024-47161In JetBrains TeamCity before 2024.07.3 password could be exp…6.5
• CVE-2024-47162In JetBrains YouTrack before 2024.3.44799 token could be rev…5.3
• CVE-2024-47164Gradio is an open-source Python package designed for quick p…6.5
• CVE-2024-47166Gradio is an open-source Python package designed for quick p…5.3
• CVE-2024-47167Gradio is an open-source Python package designed for quick p…9.8
• CVE-2024-47168Gradio is an open-source Python package designed for quick p…4.3
• CVE-2024-47169Agnai is an artificial-intelligence-agnostic multi-user, mul…8.8
• CVE-2024-4717A vulnerability was found in Campcodes Complete Web-Based Sc…6.1
• CVE-2024-47170Agnai is an artificial-intelligence-agnostic multi-user, mul…4.3