Home » Database

AVID-2026-R1608

Description

Open Redirect in gradio-app/gradio (CVE-2024-8021)

Details

An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an attacker to redirect users to a malicious website by URL encoding. This can be exploited by sending a crafted request to the application, which results in a 302 redirect to an attacker-controlled site.

Reason for inclusion in AVID: CVE-2024-8021 describes an open redirect vulnerability in gradio-app/gradio, a Python library widely used to build and deploy AI/ML apps and dashboards. This directly concerns software used in AI pipelines and general-purpose AI systems (deployment/runtime stacks, UI for models, etc.). It is a security vulnerability (open redirect) in a component that is part of AI software stacks, not hardware/firmware. The report provides CVE details and CWE mapping, indicating sufficient evidence for classification as a software supply chain vulnerability in AI systems.

References

Affected or Relevant Artifacts

  • Developer: gradio-app
  • Deployer: gradio-app
  • Artifact Details:
TypeName
Systemgradio-app/gradio

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Base Score5.4
Base Severity🟠 Medium
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality Impact🟢 Low
Integrity Impact🟢 Low
Availability ImpactNONE

CWE

IDDescription
CWE-601CWE-601 URL Redirection to Untrusted Site

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2025-03-20
  • Version: 0.3.3
  • AVID Entry