---
id: CVE-2024-4940
aliases:
  - GHSA-g6c9-f4xm-9j4x
  - PYSEC-2026-1414
title: Open redirect in gradio
summary: Open redirect in gradio
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'
vendor: gradio
product: gradio
ecosystem: pip
affected:
  - gradio <= 4.36.1
published: '2024-06-22'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:15.275278919Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-g6c9-f4xm-9j4x'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-4940'
  - url: 'https://github.com/gradio-app/gradio'
  - url: 'https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.01021
epssPercentile: 0.61967
exploits:
  nuclei:
    - CVE-2024-4940
  checkedAt: '2026-09-24T07:52:51.795Z'
exploitAvailable: true
ingestedAt: '2026-07-08T18:25:49.647Z'
---

## Overview

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.

## Affected packages

- `gradio <= 4.36.1`

## Remediation

Refer to the advisory for the patched release.