How many CVEs have a located fix in gradio-app/gradio?

23 published CVEs have a fix traced to functions in gradio-app/gradio, touching 114 functions across 43 files.

Which function in gradio-app/gradio has been patched by the most CVEs?

file in gradio/routes.py has been changed by 5 CVE fixes, from 2023 to 2026.

How large is a typical CVE fix in gradio-app/gradio?

The median fix changes 25 lines. 48% of fixes change 20 lines or fewer, and 30% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

python

typescript

#219 of 500 repositories

gradio-app/gradio

Name: gradio-app/gradio: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix July 8, 2026

23

CVE fixes located

Published CVEs

114

Functions patched

Distinct function sites

43

Files patched

Distinct source files

2021–2026

Years covered

By CVE publication date

Overview

23 published CVEs have a fix traced to functions in gradio-app/gradio, the earliest published in 2021. Those fixes changed 114 distinct functions across 43 files, in 495 patch hunks.

Among the 500 repositories tracked here, gradio-app/gradio ranks #219 by the number of CVEs with a located fix.

Most patched functions

Functions in gradio-app/gradio changed by the most CVE fixes.

Most patched files

Files in gradio-app/gradio changed by the most CVE fixes.

1gradio/routes.py13 CVEs · 22 functions
2gradio/utils.py8 CVEs · 6 functions
3gradio/blocks.py6 CVEs · 14 functions
4gradio/route_utils.py6 CVEs · 5 functions
5gradio/processing_utils.py4 CVEs · 5 functions
6gradio/data_classes.py3 CVEs · 5 functions
7gradio/components/file_explorer.py3 CVEs · 4 functions
8gradio/components/base.py3 CVEs · 2 functions
9client/python/gradio_client/utils.py2 CVEs · 11 functions
10client/js/src/client.ts2 CVEs · 4 functions

Fix size

How much code a CVE fix in gradio-app/gradio changes, with backports counted once.

25

Median lines changed

Added plus removed, per CVE

48%

Fixes of 20 lines or fewer

Share of CVE fixes

30%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in gradio-app/gradio, and the functions each fix changed.

Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint
CVE-2026-59806secure_url_stream_response file
Medium · CVSS 4.9
EPSS 0.4%2026-07-08
Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()
CVE-2026-49119preprocess
High · CVSS 8.7
EPSS 0.7%2026-07-01
gradio-app gradio Audio Cache Key save_audio_to_cache weak hash
CVE-2026-10783save_audio_to_cache
Low · CVSS 2.0
EPSS 0.1%2026-06-03
Gradio < 6.15.0 Cookie Injection via Shared Proxy Client
CVE-2026-48545reverse_proxy toorjson build_proxy_request
High · CVSS 7.6
EPSS 0.5%2026-05-27
Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing
CVE-2026-28416build_proxy_request document_fn get_block_instance
High · CVSS 8.6
EPSS 0.3%2026-02-27
Gradio has Open Redirect in OAuth Flow
CVE-2026-28415_redirect_to_target _get_mocked_oauth_info
Medium · CVSS 4.7
EPSS 0.3%2026-02-27
Gradio has Absolute Path Traversal on Windows with Python 3.13+
CVE-2026-28414safe_join
High · CVSS 7.5
EPSS 2.5%2026-02-27
Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret
CVE-2026-27167_redirect_to_target _get_mocked_oauth_info
Medium · CVSS 5.9
EPSS 0.4%2026-02-27
Denial of Service in gradio-app/gradio
CVE-2024-8966parse
High · CVSS 7.5
EPSS 0.8%2025-03-20
Gradio Blocked Path ACL Bypass Vulnerability
CVE-2025-23042is_allowed_file
Critical · CVSS 9.1
EPSS 1.0%2025-01-14
Gradio's `is_in_or_equal` function may be bypassed
CVE-2024-47164safe_join is_in_or_equal _safe_join
Medium · CVSS 6.9
EPSS 0.7%2024-10-10
Local File Inclusion in JSON component in gradio-app/gradio
CVE-2024-4941postprocess check_all_files_in_cache JsonData
High · CVSS 7.5
EPSS 0.8%2024-06-06

Get an alert for each new gradio-app/gradio CVE, with the patched functions and AI-written analysis.

Monitor gradio CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

apache/cxf23 CVEs bcgit/bc-csharp23 CVEs cilium/cilium23 CVEs debian/glibc23 CVEs debian/sdl-image1.223 CVEs file/file23 CVEs InvoicePlane/InvoicePlane23 CVEs langflow-ai/langflow23 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in gradio-app/gradio.

How many CVEs have a located fix in gradio-app/gradio?: 23 published CVEs have a fix traced to functions in gradio-app/gradio, touching 114 functions across 43 files.
Which function in gradio-app/gradio has been patched by the most CVEs?: file in gradio/routes.py has been changed by 5 CVE fixes, from 2023 to 2026.
How large is a typical CVE fix in gradio-app/gradio?: The median fix changes 25 lines. 48% of fixes change 20 lines or fewer, and 30% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track gradio-app/gradio CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing