Insecure FRP communication in Gradio share=True mode
Gradio versions before 5.0.0 did not enforce HTTPS on connections between the Fast Reverse Proxy (FRP) client and server when the share=True option was used, reportedly allowing attackers to intercept uploaded files and modify data in transit.
What happened
Gradio versions prior to 5.0.0 did not enforce HTTPS on connections between the Fast Reverse Proxy (FRP) client and server when the share=True option was used.
This allowed attackers to potentially intercept and read files uploaded to the Gradio server, as well as modify responses or data sent between the client and server.
Reported impact
Users sharing Gradio demos publicly over the internet using share=True without proper encryption were exposed to potential eavesdropping of sensitive data.
Governance controls
The vulnerability was patched in Gradio version 5.0.0.
As a workaround, users can avoid using share=True in production environments and instead host their Gradio applications on servers with HTTPS enabled.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.