CVE-2026-48545

Katalog CVE

CVSS 6.8 · Medium EPSS 0,47%

Kerentanan Session Fixation pada gradio project gradio. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across all users in the reverse proxy endpoint. Attackers controlling any HF Space can return a parent-domain cookie that the shared client stores and automatically replays into all subsequent proxy requests to other legitimate Spaces, affecting all users of the same Gradio deployment.

Rincian

Terbit di NVD

27 Mei 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-384: Session Fixation

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gradio-app/gradio/commit/feb7237d01f359d2ad4ee42d00344e61692b3b39 patch
• https://github.com/gradio-app/gradio/pull/13384 issue tracking · patch
• https://github.com/gradio-app/gradio/issues/13369 issue tracking
• https://github.com/gradio-app/gradio/releases/tag/gradio%406.15.0 product · release notes
• https://www.vulncheck.com/advisories/gradio-cookie-injection-via-shared-pro broken link