{"data":{"id":"e68e0042-5435-4761-8ccb-c2e5d276ceff","title":"CVE-2023-25823: Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions…","summary":"CVE-2023-25823 affects Gradio, an open-source Python library for building machine learning demos and web applications, in versions prior to 3.13.1. When an app uses share links by setting `share=True`, a private SSH key is sent to any user who connects to the Gradio machine, letting them reach other users' shared demos. Further exploits depend on the access the Gradio app exposes.","solution":"Patched in version 3.13.1. Users are recommended to update to 3.19.1 or later, where the FRP solution has been properly tested.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-25823","publishedAt":"2023-02-24T03:15:11.580Z","cveId":"CVE-2023-25823","cweIds":["CWE-798","CWE-798"],"cvssScore":"5.4","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@< 3.13.1 (fixed: 3.13.1)"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Gradio hard-coded credentials exposure via share links","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00553,"epssCheckedAt":"2026-11-04T18:09:14.608Z","kevDateAdded":null,"advisoryAliases":["GHSA-3x5j-9vwr-8rr5"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:57:18.213Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2022-12-15T01:14:23.037Z","daysToFix":-71,"fixCheckedAt":"2026-10-29T21:47:26.322Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"gradio","fixedVersion":"3.13.1","matchedVersion":"3.13.1","fixReleasedAt":"2022-12-15T01:14:23.037Z","daysToFix":-71,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:47:26.169Z"}]}}