PyPI/gradio CVE-2026-28416: high 8.2, EPSS 0.36%

Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing

Action: Upgrade gradio to 6.6.0 or later.

pip install gradio==6.6.0

Affected

Fixed versions

Sources

• osv: GHSA-jmh7-g254-2cq9
• https://github.com/gradio-app/gradio/security/advisories/GHSA-jmh7-g254-2cq9
• https://nvd.nist.gov/vuln/detail/CVE-2026-28416
• https://github.com/gradio-app/gradio/commit/fc7c01ea1e581ef70be98fddf003b0c91315c7cc
• https://github.com/gradio-app/gradio
• https://github.com/gradio-app/gradio/releases/tag/gradio%406.6.0
• https://github.com/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2026-66.yaml

CVE-2026-28416 · published 2026-03-01T01:29:31Z · modified 2026-06-06T00:30:08.758537972Z · JSON