CVE-2026-10783 json
gradio-app gradio Audio Cache Key save_audio_to_cache weak hash
published 5mo ago modified 3mo ago also GHSA-6655-8ph2-63j3 , PYSEC-2026-211 , EUVD-2026-34187
- cvss
- 2.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 1%
- public exploits
- 0
- none known
Summary
A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Performing a manipulation results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The patch is named 13394. To fix this issue, it is recommended to deploy a patch.
Patch / fix
- pypi gradio 6.15.1
- github.com/gradio-app/gradio@1c609af commit
- github.com/gradio-app/gradio#13394 pull request
Is CVE-2026-10783 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5mo ago
Exploit prediction
0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- github.com https://github.com/gradio-app/gradio/issues/13395 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.0 | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 2.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
| CNA | 3.0 | 2.5 | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
| CNA | 2.0 | 1.0 | AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C |
| CNA | 4.0 | 1.1 | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 2.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 2.0 | 1.0 | AV:L/AC:H/Au:S/C:P/I:N/A:N |
| GitHub | 3.1 | 2.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 2.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | gradio | <6.15.1 <=6.14.0 |
6.15.1 |
Affected products
- gradio-app gradio
Classification
References
-
github.com
/gradio-app/gradio/pull/13394
issue-tracking, patch, web
-
github.com
/gradio-app/gradio/commit/1c609af6918b20d0b4347b9f41b04569d6adca24
web
-
github.com
/gradio-app/gradio/issues/13395
exploit, issue-tracking, web, report
-
vuldb.com
/vuln/368140
vdb-entry, technical-description, web, third-party-advisory, advisory
-
vuldb.com
/vuln/368140/cti
signature, permissions-required, web, vdb-entry, report
-
vuldb.com
/cve/CVE-2026-10783
third-party-advisory, web, vdb-entry, advisory
-
vuldb.com
/submit/831451
third-party-advisory, web, vdb-entry, advisory
-
github.com
/gradio-app/gradio/
product, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-10783
advisory
-
github.com
/gradio-app/gradio
package
-
github.com
/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2026-211.yaml
web
-
github.com
/advisories/GHSA-6655-8ph2-63j3
advisory
Sources
- CVE List CVE-2026-10783
- GitHub Advisory GHSA-6655-8ph2-63j3
- NVD CVE-2026-10783
- OSV PYSEC-2026-211
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.