Executive brief
Gradio, a popular Python library for building machine learning web interfaces, contains a vulnerability in how it handles web requests through its proxy service. An attacker who controls a malicious "Space" (a hosted Gradio app) can inject tracking or session cookies into the shared system. This allows the attacker to potentially hijack the sessions of other users or impersonate them when they interact with legitimate applications on the same platform.
Technical details
Gradio versions prior to 6.15.0 utilize a shared, module-level httpx.AsyncClient for the /proxy={url} endpoint. This shared client automatically persists 'Set-Cookie' headers in a global cookie jar. An attacker controlling a malicious Hugging Face Space can return a cookie with 'Domain=hf.space', which the shared client then replays in subsequent requests to any other legitimate Space on the same parent domain. This results in session fixation, where a victim's request to a legitimate service is forced to use a session identifier known to the attacker. The vulnerability is mitigated in version 6.15.0 by isolating cookie jars.
Affected products
- Gradio Gradio < 6.15.0
Timeline
- 2026-05-07: disclosed: Initial report via GitHub issues
- 2026-05-27: advisory: GHSA and CVE published
- 2026-05-27: patched: Version 6.15.0 released
References
- https://github.com/gradio-app/gradio/issues/13369
- https://github.com/gradio-app/gradio/pull/13384
- https://github.com/gradio-app/gradio/commit/feb7237d01f359d2ad4ee42d00344e61692b3b39
- https://www.vulncheck.com/advisories/gradio-cookie-injection-via-shared-pro
- https://github.com/gradio-app/gradio/releases/tag/gradio@6.15.0