CVE-2024-47870

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **race condition** in the `update_root_in_config` function, allowing an attacker to modify the `root` URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition. Users are advised to upgrade to `gradio>=5` to address this issue. There are no known workarounds for this issue.

• CWE-362

• https://github.com/gradio-app/gradio/security/advisories/GHSA-xh2x-3mrm-fwqmThird Party Advisory

Published

Oct 10, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-47865Missing authentication for critical function vulnerability e…5.3
• CVE-2024-47866Ceph is a distributed object, block, and file storage platfo…7.5
• CVE-2024-47867Gradio is an open-source Python package designed for quick p…7.5
• CVE-2024-47868Gradio is an open-source Python package designed for quick p…7.5
• CVE-2024-47869Gradio is an open-source Python package designed for quick p…3.7
• CVE-2024-4787The Cost Calculator Builder PRO for WordPress is vulnerable …5.8
• CVE-2024-47871Gradio is an open-source Python package designed for quick p…9.1
• CVE-2024-47872Gradio is an open-source Python package designed for quick p…5.4
• CVE-2024-47873PhpSpreadsheet is a PHP library for reading and writing spre…7.5
• CVE-2024-47874Starlette is an Asynchronous Server Gateway Interface (ASGI)…8.7
• CVE-2024-47875DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanit…6.1
• CVE-2024-47876Sakai is a Collaboration and Learning Environment. Starting …8.8