A security audit found a remote code execution bug in Gradio, the tool behind 470,000 AI apps

The team behind Gradio, the Python library so ubiquitous it clocks over 6 million monthly PyPI installs, just did something most open-source projects talk about but rarely execute: they hired cybersecurity firm Trail of Bits for a preemptive, independent audit. They’re not just patching hole after hole reported by the community anymore. With over 470,000 Gradio apps live on Hugging Face Spaces, they went looking for the skeletons in the closet and published the entire grim report for everyone to see.

The audit uncovered a genuinely alarming list of vulnerabilities across four attack surfaces. The scariest? TOB-GRADIO-19, a remote code execution (RCE) bug on the Gradio API server, achieved via an nginx misconfiguration that exposed an unauthenticated Docker API. An attacker could hijack all traffic—uploaded files, chatbot conversations, everything—by rerouting it to a malicious server. That’s a nightmare scenario for anyone sharing sensitive data through a seemingly private prototype. Other critical finds included a full-read Server-Side Request Forgery (SSRF) bug (TOB-GRADIO-3) that let attackers poke around internal networks, and a race condition (TOB-GRADIO-13) that could silently redirect user traffic to steal files.

What’s notable is how Gradio’s core promise—dead-simple, code-light deployment—directly clashed with security. The Trail of Bits team pointed out the unique challenge: making web apps secure usually requires developers to configure complex CORS and CSP policies, the exact friction Gradio was designed to eliminate. The fixes, all validated and baked into the Gradio 5.0 release, had to maintain that one-line launch(share=True) simplicity. You can now upgrade without rewriting your app, and the dangerous defaults are gone.

This marks a maturation point for the entire Hugging Face ecosystem. We’ve seen the AI world obsess over model safety and alignment while deploying those models behind swiss-cheese web interfaces. Gradio pulling back the curtain on its own flaws, and fixing them before a major breach, sets a standard that Streamlit and other competitors should feel pressure to match. The full report is public, and reading it is a stark reminder that your chatbot’s biggest threat isn’t a prompt injection—it’s an unpatched nginx config.