title: Tighten CORS rules
description: To prevent malicious 3rd party websites from making requests to Gradio applications running locally, this PR tightens the CORS rules around Gradio applications. In particular, it checks to see if the host header is localhost (or one of its aliases) and if so, it requires the origin header (if present) to be localhost (or one of its aliases) as well.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
vendor: gradio-app
product: gradio-app/gradio
versions:
version: unspecified, lessThan: 4.19.2, status: affected, versionType: custom
}
metrics:
cvssV3_0: [
version: 3.0
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
baseScore: 4.3
baseSeverity: MEDIUM
]