CVE-2024-0964

9.4 criticalEPSS 1.0%

Critical (9.4) in gradio project gradio. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in gradio 4.9.0.

A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.

Severity

9.4 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2024-02-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-f3h9-8phc-6gvh	PyPI	gradio	<4.9.0	4.9.0
PYSEC-2024-261	PyPI	gradio		no fix published