How severe is CVE-2024-8021?

CVE-2024-8021 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2024-8021 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-8021?

CVE-2024-8021 affects Gradio Project Gradio. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-8021?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-8021 have an EU (EUVD) identifier?

Yes. CVE-2024-8021 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-6925.

When was CVE-2024-8021 published?

CVE-2024-8021 was published on 2025-03-20 and last updated on 2026-06-17.

CVE-2024-8021

CVE-2024-8021 is a medium-severity vulnerability in Gradio Project Gradio with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-601.

Key facts

Severity: Medium (CVSS 3.x base score 6.1)
EPSS exploit prediction: 1% (50th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-6925
Weakness: CWE-601
Affected product: Gradio Project Gradio
Published: 2025-03-20
Last modified: 2026-06-17

Description

An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an attacker to redirect users to a malicious website by URL encoding. This can be exploited by sending a crafted request to the application, which results in a 302 redirect to an attacker-controlled site.

Frequently asked questions

What is CVE-2024-8021?: An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an attacker to redirect users to a malicious website by URL encoding. This can be exploited by sending a crafted request to the application, which results in a 302 redirect to an attacker-controlled site.
How severe is CVE-2024-8021?: CVE-2024-8021 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2024-8021 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-8021?: CVE-2024-8021 affects Gradio Project Gradio. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-8021?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-8021 have an EU (EUVD) identifier?: Yes. CVE-2024-8021 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-6925.
When was CVE-2024-8021 published?: CVE-2024-8021 was published on 2025-03-20 and last updated on 2026-06-17.

References

https://huntr.com/bounties/adc23067-ec04-47ef-9265-afd452071888

Affected products (1)

cpe:2.3:a:gradio_project:gradio:-:*:*:*:*:python:*:*

More vulnerabilities in Gradio Project Gradio

CVE-2024-47167 — Critical (CVSS 9.8): Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **Server-Side…
CVE-2024-39236 — Critical (CVSS 9.8): Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py.…
CVE-2024-0964 — Critical (CVSS 9.4): A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API…
CVE-2024-47871 — Critical (CVSS 9.1): Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **insecure…
CVE-2024-4253 — Critical (CVSS 9.1): A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the…
CVE-2022-24770 — High (CVSS 8.8): `gradio` is an open source framework for building interactive machine learning models and demos. Prior to version…

All CVEs affecting Gradio Project Gradio →

Other CWE-601 (Open Redirect) vulnerabilities

CVE-2018-3774 — Critical (CVSS 10.0): Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open…
CVE-2019-25282 — Critical (CVSS 9.8): V-SOL GPON/EPON OLT Platform v2.03 contains an open redirect vulnerability in the script that allows attackers to…
CVE-2020-36912 — Critical (CVSS 9.8): Plexus anblick Digital Signage Management 3.1.13 contains an open redirect vulnerability in the 'PantallaLogin' script…
CVE-2025-43526 — Critical (CVSS 9.8): This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac…
CVE-2025-55031 — Critical (CVSS 9.8): Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An…
CVE-2024-22891 — Critical (CVSS 9.8): Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.

Browse all CWE-601 (Open Redirect) vulnerabilities →