Search for packages
| purl | pkg:pypi/nicegui@2.13.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-fwyg-jtwk-kkbh
Aliases: CVE-2026-25732 GHSA-9ffm-fxg3-xrhh PYSEC-2026-95 |
NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames containing ../ sequences allow attackers to write files outside intended directories, with potential for remote code execution through application file overwrites in vulnerable deployment patterns. This design creates a prevalent security footgun affecting applications following common community patterns. Note: Exploitation requires application code incorporating file.name into filesystem paths without sanitization. Applications using fixed paths, generated filenames, or explicit sanitization are not affected. This vulnerability is fixed in 3.7.0. |
Affected by 0 other vulnerabilities. |
|
VCID-r9bg-bs31-q3gu
Aliases: CVE-2026-21871 GHSA-7grm-h62g-5m97 |
NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace() XSS risk exists in NiceGUI when developers pass attacker-controlled strings into `ui.navigate.history.push()` or `ui.navigate.history.replace()`. These helpers are documented as History API wrappers for updating the browser URL without page reload. However, if the URL argument is embedded into generated JavaScript without proper escaping, a crafted payload can break out of the intended string context and execute arbitrary JavaScript in the victim’s browser. **Applications that do not pass untrusted input into `ui.navigate.history.push/replace` are not affected.** |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-02T04:49:26.154587+00:00 | GitLab Importer | Affected by | VCID-r9bg-bs31-q3gu | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/nicegui/CVE-2026-21871.yml | 38.6.0 |
| 2026-06-02T04:23:52.664803+00:00 | Pypa Importer | Affected by | VCID-fwyg-jtwk-kkbh | https://github.com/pypa/advisory-database/blob/main/vulns/nicegui/PYSEC-2026-95.yaml | 38.6.0 |