---
id: CVE-2023-34239
aliases:
  - GHSA-3qqg-pgqq-3695
  - PYSEC-2023-90
title: Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs
summary: Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
vendor: gradio
product: gradio
ecosystem: pip
affected:
  - gradio < 3.34.0
patched:
  - gradio 3.34.0
published: '2023-06-09'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:01.984709665Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3qqg-pgqq-3695'
references:
  - url: >-
      https://github.com/gradio-app/gradio/security/advisories/GHSA-3qqg-pgqq-3695
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-34239'
  - url: 'https://github.com/gradio-app/gradio/pull/4370'
  - url: 'https://github.com/gradio-app/gradio/pull/4406'
  - url: >-
      https://github.com/gradio-app/gradio/commit/37967617bd97615fb6f3b44e7750c0e0be58479a
  - url: >-
      https://github.com/gradio-app/gradio/commit/37967617bd97615fb6f3b44e7750c0e0be58479a#diff-324a7165f5d5a8823a28b76f5653fa45f32c8144c82b2e528882c97c7eae534f
  - url: >-
      https://github.com/gradio-app/gradio/commit/cd64130d54e678525774bbb200ef9c7166fa1543
  - url: 'https://github.com/gradio-app/gradio'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2023-90.yaml
tags:
  - osv
  - pip
epss: 0.00651
epssPercentile: 0.49786
ingestedAt: '2026-09-12T03:13:01.647Z'
---

## Overview

### Impact
There are two separate security vulnerabilities here: (1) a security vulnerability that allows users to read arbitrary files on the machines that are running shared Gradio apps (2) the ability of users to use machines that are sharing Gradio apps to proxy arbitrary URLs

### Patches
Both problems have been solved, please upgrade `gradio` to `3.34.0` or higher

### Workarounds
Not possible to workaround except by taking down any shared Gradio apps

### References
Relevant PRs:
* https://github.com/gradio-app/gradio/pull/4406
* https://github.com/gradio-app/gradio/pull/4370

## Affected packages

- `gradio < 3.34.0`

## Remediation

Upgrade to a patched release:

- `gradio 3.34.0`