{"cve":"CVE-2024-47165","nvd":{"published":"2024-10-10T22:15:10.680","modified":"2026-06-17T07:56:39.407","status":"Analyzed","description":"Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **CORS origin validation accepting a null origin**. When a Gradio server is deployed locally, the `localhost_aliases` variable includes \"null\" as a valid origin. This allows attackers to make unauthorized requests from sandboxed iframes or other sources with a null origin, potentially leading to data theft, such as user authentication tokens or uploaded files. This impacts users running Gradio locally, especially those using basic authentication. Users are advised to upgrade to `gradio>=5.0` to address this issue. As a workaround, users can manually modify the `localhost_aliases` list in their local Gradio deployment to exclude \"null\" as a valid origin. By removing this value, the Gradio server will no longer accept requests from sandboxed iframes or sources with a null origin, mitigating the potential for exploitation.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","score":5.4},"cwes":["CWE-285"],"references":["https://github.com/gradio-app/gradio/security/advisories/GHSA-89v2-pqfv-c5r9"],"products":["gradio_project:gradio"],"source":"nvd","synced_at":"2026-10-19T21:55:31.737901711+00:00"},"epss":{"cve":"CVE-2024-47165","score":0.00298,"percentile":0.22568,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-89v2-pqfv-c5r9","url":"https://osv.dev/vulnerability/GHSA-89v2-pqfv-c5r9","summary":"Gradio's CORS origin validation accepts the null origin","modified":"2025-01-21T18:20:37.159111Z","packages":[{"ecosystem":"PyPI","name":"gradio","purl":"pkg:pypi/gradio","ranges":["<5.0.0"],"fixed":["5.0.0"]}]},{"id":"PYSEC-2024-214","url":"https://osv.dev/vulnerability/PYSEC-2024-214","summary":"","modified":"2025-01-19T22:56:52.587676Z","packages":[{"ecosystem":"PyPI","name":"gradio","purl":"pkg:pypi/gradio","ranges":["<5.0.0"],"fixed":["5.0.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}