Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across all users in the reverse proxy endpoint. Attackers controlling any HF Space can return a parent-domain cookie that the shared client stores and automatically replays into all subsequent proxy requests to other legitimate Spaces, affecting all users of the same Gradio deployment.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 Gradio, Cookie Injection Vulnerability, #CVE-2026-48545 (Medium) -DC-Jun2026-89 https://dailycve.com/gradio-cookie-injection-vulnerability-cve-2026-48545-medium-dc-jun2026-89/
Post summary
An article announces CVE-2026-48545, a Medium‑severity cookie injection flaw in Gradio, without providing PoC, exploit details, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gradio_project | gradio | - | python | - |