{"id":"CVE-2023-25823","aliases":["GHSA-3x5j-9vwr-8rr5","PYSEC-2023-16"],"url":"https://o3.security/vulnerability/CVE-2023-25823","summary":"Gradio contains Use of Hard-coded Credentials","details":"### Impact\nThis is a vulnerability which affects anyone using Gradio's share links (i.e. creating a Gradio app and then setting `share=True`) with Gradio versions older than 3.13.1. In these older versions of Gradio, a private SSH key is sent to any user that connects to the Gradio machine, which means that a user could access other users' shared Gradio demos. From there, other exploits are possible depending on the level of access/exposure the Gradio app provides. \n\n### Patches\nThe problem has been patched. Ideally, users should upgrade to `gradio==3.19.1` or later where the FRP solution has been properly tested. \n\n### Credit\nCredit to Greg Sadetsky and Samuel Tremblay-Cossette for alerting the team","published":"2023-02-23T21:34:33.129Z","modified":"2026-10-28T02:30:39.078928144Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L"},"epss":{"score":0.00553,"percentile":0.43727,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"gradio","fixedVersion":"3.13.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25823.json"},{"type":"ADVISORY","url":"https://github.com/gradio-app/gradio/security/advisories/GHSA-3x5j-9vwr-8rr5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25823"},{"type":"PACKAGE","url":"https://github.com/gradio-app/gradio"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2023-16.yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:39.078928144Z"}}