CVE-2023-25823
Gradio contains Use of Hard-coded Credentials
- State
- Published
- Severity
- 5.4 Medium
- Published
- Feb 23, 2023
- Updated
- Mar 10, 2025
- Reserved
- Feb 15, 2023
Description
Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-coded Credentials. When using Gradio's share links (i.e. creating a Gradio app and then setting `share=True`), a private SSH key is sent to any user that connects to the Gradio machine, which means that a user could access other users' shared Gradio demos. From there, other exploits are possible depending on the level of access/exposure the Gradio app provides. This issue is patched in version 3.13.1, however, users are recommended to update to 3.19.1 or later where the FRP solution has been properly tested.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L | GitHub_M |
Weaknesses
- CWE-798 Use of Hard-coded Credentials
Affected Products
| Product | Versions |
|---|---|
gradiogradio-app |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.