CVE-2024-0964: Gradio Path Traversal vulnerability

February 6, 2024 (updated May 19, 2026)

A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.

References

github.com/advisories/GHSA-f3h9-8phc-6gvh
github.com/gradio-app/gradio/commit/d76bcaaaf0734aaf49a680f94ea9d4d22a602e70
github.com/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2024-261.yaml
huntr.com/bounties/25e25501-5918-429c-8541-88832dfd3741
nvd.nist.gov/vuln/detail/CVE-2024-0964

Code Behaviors & Features

Detect and mitigate CVE-2024-0964 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →