CVE-2024-4940 MEDIUM

CVE-2024-4940: Open Redirect in gradio-app/gradio

Vendor Gradio-App
Product gradio-app/gradio
Weakness CWE-601 · Open redirect
Published June 22, 2024
Last update October 15, 2025

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.

Key dates

02Disclosure timeline

June 22, 2024 CVE published
October 15, 2025 Record updated