CVE-2026-10783 json
gradio-app gradio Audio Cache Key save_audio_to_cache weak hash
published 2026-06-03 5 mo ago modified 2026-07-23 3 mo ago also GHSA-6655-8ph2-63j3 , PYSEC-2026-211 , EUVD-2026-34187
- cvss
- 2.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 1%
- public exploits
- 0
- none known
Summary
A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Performing a manipulation results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The patch is named 13394. To fix this issue, it is recommended to deploy a patch.
Patch / fix
- pypi gradio 6.15.1
- github.com/gradio-app/gradio@1c609af commit
- github.com/gradio-app/gradio#13394 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/gradio-app/gradio/issues/13395 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.0 | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 2.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
| CNA | 3.0 | 2.5 | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
| CNA | 2.0 | 1.0 | AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C |
| CNA | 4.0 | 1.1 | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 2.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 2.0 | 1.0 | AV:L/AC:H/Au:S/C:P/I:N/A:N |
| GitHub | 3.1 | 2.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 2.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | gradio | <6.15.1 <=6.14.0 |
6.15.1 |
Affected products
- gradio-app gradio
Classification
References
-
github.com
/gradio-app/gradio/pull/13394
issue-tracking, patch, web
-
github.com
/gradio-app/gradio/commit/1c609af6918b20d0b4347b9f41b04569d6adca24
web
-
github.com
/gradio-app/gradio/issues/13395
exploit, issue-tracking, web, report
-
vuldb.com
/vuln/368140
vdb-entry, technical-description, web, third-party-advisory, advisory
-
vuldb.com
/vuln/368140/cti
signature, permissions-required, web, vdb-entry, report
-
vuldb.com
/cve/CVE-2026-10783
third-party-advisory, web, vdb-entry, advisory
-
vuldb.com
/submit/831451
third-party-advisory, web, vdb-entry, advisory
-
github.com
/gradio-app/gradio/
product, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-10783
advisory
-
github.com
/gradio-app/gradio
package
-
github.com
/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2026-211.yaml
web
-
github.com
/advisories/GHSA-6655-8ph2-63j3
advisory
Sources
- CVE List CVE-2026-10783
- GitHub Advisory GHSA-6655-8ph2-63j3
- NVD CVE-2026-10783
- OSV PYSEC-2026-211
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.