{"id":"CVE-2023-25823","aliases":["GHSA-3x5j-9vwr-8rr5","PYSEC-2023-16"],"title":"Update share links to use FRP instead of SSH tunneling","summary":"Update share links to use FRP instead of SSH tunneling","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L","vendor":"gradio","product":"gradio","ecosystem":"pip","affected":["gradio < 3.13.1"],"patched":["gradio 3.13.1"],"published":"2023-02-23","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:51.933952347Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-3x5j-9vwr-8rr5","references":[{"url":"https://github.com/gradio-app/gradio/security/advisories/GHSA-3x5j-9vwr-8rr5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25823"},{"url":"https://github.com/gradio-app/gradio"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2023-16.yaml"}],"tags":["osv","pip"],"epss":0.00553,"epssPercentile":0.44793,"ingestedAt":"2026-09-12T03:13:01.649Z","slug":"CVE-2023-25823","body":"## Overview\n\n### Impact\nThis is a vulnerability which affects anyone using Gradio's share links (i.e. creating a Gradio app and then setting `share=True`) with Gradio versions older than 3.13.1. In these older versions of Gradio, a private SSH key is sent to any user that connects to the Gradio machine, which means that a user could access other users' shared Gradio demos. From there, other exploits are possible depending on the level of access/exposure the Gradio app provides. \n\n### Patches\nThe problem has been patched. Ideally, users should upgrade to `gradio==3.19.1` or later where the FRP solution has been properly tested. \n\n### Credit\nCredit to Greg Sadetsky and Samuel Tremblay-Cossette for alerting the team\n\n## Affected packages\n\n- `gradio < 3.13.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `gradio 3.13.1`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}