Gradio, a popular Python library, contains a Server‑Side Request Forgery that allows an attacker to make arbitrary HTTP calls from a victim server by hosting a malicious Space. When a victim application invokes gr.load() with a Space controlled by the attacker, the Space configuration’s proxy_url is added to the allow‑list without validation. This exposes the victim server to requests to internal services, cloud metadata endpoints, and other private networks, potentially leaking sensitive data or enabling lateral movement within the victim’s infrastructure.

The vulnerability affects the Gradio open‑source Python package before version 6.6.0 from the Gradio‑App project. Any deployment of Gradio prior to 6.6.0 that uses gr.load() to load external Spaces is susceptible.

With a CVSS score of 8.2 the flaw is considered high severity. The EPSS score is below 1 %, indicating a low immediate exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the exploit path is straightforward for anyone able to host a malicious Space; a victim application that automatically loads user‑supplied Spaces would allow the attacker to trigger the SSRF.