Update share links to use FRP instead of SSH tunneling

NGHIÊM TRỌNG 9.8CVE-2023-25823 · GHSA-3x5j-9vwr-8rr5 · PYSEC-2023-16 · Công bố 23/02/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-25823 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng gradio, gradio (gradio project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.55%, cao hơn 46.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.13.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
gradio PyPI	`< 3.13.1`	`3.13.1`
gradio gradio_project	`< 3.13.1`	`3.13.1`

Mô tả

Impact

This is a vulnerability which affects anyone using Gradio's share links (i.e. creating a Gradio app and then setting share=True) with Gradio versions older than 3.13.1. In these older versions of Gradio, a private SSH key is sent to any user that connects to the Gradio machine, which means that a user could access other users' shared Gradio demos. From there, other exploits are possible depending on the level of access/exposure the Gradio app provides.

Patches

The problem has been patched. Ideally, users should upgrade to gradio==3.19.1 or later where the FRP solution has been properly tested.

Credit

Credit to Greg Sadetsky and Samuel Tremblay-Cossette for alerting the team

Mô tả của NVD

Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-coded Credentials. When using Gradio's share links (i.e. creating a Gradio app and then setting `share=True`), a private SSH key is sent to any user that connects to the Gradio machine, which means that a user could access other users' shared Gradio demos. From there, other exploits are possible depending on the level of access/exposure the Gradio app provides. This issue is patched in version 3.13.1, however, users are recommended to update to 3.19.1 or later where the FRP solution has been properly tested.