Python| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|
| gradio | pip | < 4.19.2 | 4.19.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from improper CORS configuration in routes.py. The pre-patch code added a CORSMiddleware with wildcard permissions, failing to restrict requests to same-origin when running locally. The fix introduced a CustomCORSMiddleware that validates host/origin alignment for localhost environments. The vulnerable function is the middleware setup in create_app() where the insecure CORS policy was implemented.
KEV Misses 88% of Exploited CVEs- Get the report
