Gradio's Component Server does not properly consider` _is_server_fn` for functions

published 2024-05-05 2y ago modified 2026-09-10 2mo ago also CVE-2024-34511 , PYSEC-2026-1407

cvss: 6.5; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

Component Server in Gradio before 4.13 does not properly consider` _is_server_fn` for functions.

Patch / fix

fixed in 1 links 1

pypi gradio 4.13.0

github.com/gradio-app/gradio@24a5836 commit

Is GHSA-34rf-p3r3-58x2 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
OSV	3.1	6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	gradio	<4.13.0	4.13.0

References

github.com /gradio-app/gradio/commit/24a583688046867ca8b8b02959c441818bdb34a2
web, patch
nvd.nist.gov /vuln/detail/CVE-2024-34511
advisory
github.com /gradio-app/gradio
package
gradio.app /changelog#4-13-0
web
pypi.org /project/gradio
package
github.com /advisories/GHSA-34rf-p3r3-58x2
advisory

Sources

GitHub Advisory GHSA-34rf-p3r3-58x2
OSV PYSEC-2026-1407

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.