Cookie Injection Vulnerability in Gradio by Gradio-App

CVE-2026-48545

What is CVE-2026-48545?

Gradio, a popular open-source framework for building machine learning interfaces, has a vulnerability that allows remote attackers to exploit a shared module-level HTTP client. This flaw enables attackers controlling any HF Space to perform cross-Space session fixation. By injecting a parent-domain cookie, attackers can manipulate the shared client, which stores this cookie and automatically replays it into subsequent proxy requests to other legitimate Spaces. This can potentially compromise all users within the affected Gradio deployment, raising significant security concerns.

References