Read the docs
TI-2026-09262 Aliases CVE-2026-10783GHSA-6655-8ph2-63j3

gradio-app gradio Audio Cache Key save_audio_to_cache weak hash

Priority MEDIUM 44CWE-327Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-327.

Summary

A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Performing a manipulation results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The patch is named 13394. To fix this issue, it is recommended to deploy a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00106 1st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed gradio (PyPI): 6.15.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gradio-appgradio6.14.0—No fix listedCNA
—gradio (PyPI)before 6.15.16.15.1Patch availableGHSA-6655-8ph2-63j3
  • gradio Vendorgradio-app Affected 6.14.0 Fixed in — No fix listed CNA
  • gradio (PyPI) Vendor— Affected before 6.15.1 Fixed in 6.15.1 Patch available GHSA-6655-8ph2-63j3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gradio_project:gradio:6.14.0:*:*:*:*:python:*:*6.14.0Vulnerablegradio-app
  • cpe:2.3:a:gradio_project:gradio:6.14.0:*:*:*:*:python:*:* Versions 6.14.0 Vulnerable ·gradio-app

Remediation

  • Fix · GHSA-6655-8ph2-63j3 gradio (PyPI) Fixed in 6.15.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-10783
  2. 2026-10-03 Alias added: GHSA-6655-8ph2-63j3

References

Exploit 1

Patch 1

Advisory 1

Other 4

  • TI-2024-26222 Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component… CVSS 3.1CRITICAL 9.8
  • TI-2024-01607 Local File Inclusion in gradio-app/gradio CVSS 3.1HIGH 7.5
  • TI-2024-00889 LFI in Gradio CVSS 3.1CRITICAL 9.4
  • TI-2025-16852 Gradio Blocked Path ACL Bypass Vulnerability CVSS 4.0HIGH 8.7
  • TI-2026-22690 Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing CVSS 3.1HIGH 8.6
  • TI-2024-09866 Path Traversal in gradio-app/gradio CVSS 3.0HIGH 8.2
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences