Package Instance

NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
### Summary

The upload filename sanitization introduced in GHSA-9ffm-fxg3-xrhh uses `PurePosixPath(filename).name` to strip path components. Since `PurePosixPath` only recognizes forward slashes (`/`) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (`\`) in the upload filename.

Applications that construct file paths using `file.name` (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows.

### Details

The sanitization in `nicegui/elements/upload_files.py` uses:

```python
filename = PurePosixPath(upload.filename or '').name
```

`PurePosixPath` treats backslashes as literal characters, not path separators:

```python
>>> PurePosixPath('..\\..\\secret\\evil.txt').name
'..\\..\\secret\\evil.txt'  # Not stripped!
```

When this filename is used in a path operation on Windows (e.g., `Path('uploads') / file.name`), Windows `Path` interprets backslashes as directory separators, resolving the path outside the intended directory.

### Impact

On Windows deployments of NiceGUI applications that use `file.name` in path construction:

- **Arbitrary file write** outside the intended upload directory
- **Potential remote code execution** through overwriting application files or placing executables in known locations
- **Data integrity loss** through overwriting existing files

Linux and macOS are not affected, as they treat backslashes as literal filename characters.

NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
## Summary

NiceGUI's `app.add_media_file()` and `app.add_media_files()` media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and force the server to load entire files into memory at once.

With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service.

## Impact

**Affected applications:** NiceGUI applications that serve media content via `app.add_media_file()` or `app.add_media_files()`, particularly those serving large files (video, audio).

**What an attacker can do:**
- Force the server to load entire files into memory instead of streaming them in chunks
- Amplify memory usage with concurrent requests to large media files
- Cause performance degradation, memory pressure, and potential OOM conditions

**Attack difficulty:** Low - requires only a crafted query parameter.

## Remediation

Upgrade to a patched version of NiceGUI.

As a workaround, restrict access to media endpoints or strip unexpected query parameters at a reverse proxy layer.

NiceGUI vulnerable to XSS via Code Injection during client-side element function execution
Several NiceGUI APIs that execute methods on client-side elements (`Element.run_method()`, `AgGrid.run_grid_method()`, `EChart.run_chart_method()`, and others) use an `eval()` fallback in the JavaScript-side `runMethod()` function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser.

Additionally, `Element.run_method()` and `Element.get_computed_prop()` used string interpolation instead of `json.dumps()` for the method/property name, allowing quote injection to break out of the intended string context.