CVE-2025-5320 | gradio-app gradio up to 5.29.1 CORS is_valid_origin localhost_aliases origin validation

A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function is_valid_origin of the component CORS Handler. The manipulation of the argument localhost_aliases leads to origin validation error.

This vulnerability is uniquely identified as CVE-2025-5320. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.