SOURCE-LINKED INTELLIGENCE
GHSA-7hp7-4p35-3cx2: Gradio contains a cookie injection vulnerability
Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across all users in the reverse proxy endpoint. Attackers controlling any HF Space can return a parent-domain cookie that the shared client stores and automatically replays into all subsequent proxy requests to other legitimate Spaces, affecting all users of the same Gradio deployment.
Read original source ↗ Open in workspace
- recordType
- vulnerability
- status
- active
- evidenceStatus
- reported
- region
- Global
Evidence & attribution
- OSV AI package advisories · 2026-05-27T15:33:26.000Z
- OSV AI package advisories · 2026-05-27T15:16:31.020Z
First collected: 2026-09-19T20:28:21.856Z. This is not the publication date.