PT-2025-23161 · Gradio · Gradio

Gavin Zhong

+2

·

Published

2025-05-29

·

Updated

2025-06-01

·

CVE-2025-5320

CVSS v3.1

3.7

Low

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions gradio-app gradio versions up to 5.29.1
Description A problematic vulnerability has been found in the CORS Handler component, specifically affecting the is valid origin function. The issue arises from the manipulation of the localhost aliases argument, leading to an origin validation error. This vulnerability can be exploited remotely, with a relatively high complexity of attack and difficult exploitability. The exploit has been publicly disclosed.
Recommendations For versions up to 5.29.1, as a temporary workaround, consider restricting the use of the is valid origin function in the CORS Handler component until a patch is available. Additionally, be cautious when using the localhost aliases argument to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Verification of Data Authenticity

Origin Validation Error

Weakness Enumeration

CWE-345CWE-346

Related Identifiers

CVE-2025-5320
GHSA-WMJH-CPQJ-4V6X

Affected Products

Gradio