| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-3tv5-etjd-q3hr |
| vulnerability_id |
VCID-3tv5-etjd-q3hr |
| summary |
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.add_css, ui.add_scss, and ui.add_sass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended <style> or <script> tags by injecting closing tags (e.g., </style> or </script>), allowing for the execution of arbitrary JavaScript. This issue is fixed in version 3.4.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-66469, GHSA-72qc-wxch-74mg
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3tv5-etjd-q3hr |
|
| 1 |
| url |
VCID-6jca-vw6d-ubdp |
| vulnerability_id |
VCID-6jca-vw6d-ubdp |
| summary |
NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and force the server to load entire files into memory at once. With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service. This issue has been patched in version 3.9.0. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/zauberzeug/nicegui |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/zauberzeug/nicegui |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-33332, GHSA-w5g8-5849-vj76
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6jca-vw6d-ubdp |
|
| 2 |
| url |
VCID-94cg-b1b8-f3ag |
| vulnerability_id |
VCID-94cg-b1b8-f3ag |
| summary |
NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting (XSS) when developers render unescaped user input into the DOM using ui.html(). NiceGUI did not enforce HTML or JavaScript sanitization, so applications that directly combine components like ui.input() with ui.html() or ui.chat_message with HTML content without escaping may allow attackers to execute arbitrary JavaScript in the user’s browser. Applications that do not pass untrusted input into ui.html() are not affected. This issue is fixed in version 3.0.0. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/nicegui@3.0.0 |
| purl |
pkg:pypi/nicegui@3.0.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-3tv5-etjd-q3hr |
|
| 1 |
| vulnerability |
VCID-4bwj-5kq4-nfas |
|
| 2 |
| vulnerability |
VCID-6jca-vw6d-ubdp |
|
| 3 |
| vulnerability |
VCID-77re-u8ec-8qdx |
|
| 4 |
| vulnerability |
VCID-9r69-v46g-nbea |
|
| 5 |
| vulnerability |
VCID-ch7g-e8bv-mkck |
|
| 6 |
| vulnerability |
VCID-cw8a-xpmx-kfh9 |
|
| 7 |
| vulnerability |
VCID-m48n-q2g3-4fgd |
|
| 8 |
| vulnerability |
VCID-mtpf-xq2a-9ubk |
|
| 9 |
| vulnerability |
VCID-p7ts-gwhs-bqda |
|
| 10 |
| vulnerability |
VCID-wgp7-za8k-bqaq |
|
| 11 |
| vulnerability |
VCID-yjjx-r1vh-d3gn |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/nicegui@3.0.0 |
|
|
| aliases |
CVE-2025-53354, GHSA-8c95-hpq2-w46f
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-94cg-b1b8-f3ag |
|
| 3 |
| url |
VCID-byww-65h7-efcu |
| vulnerability_id |
VCID-byww-65h7-efcu |
| summary |
NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in incognito mode. This vulnerability is fixed in 2.9.1. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-21618, GHSA-v6jv-p6r8-j78w
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-byww-65h7-efcu |
|
| 4 |
| url |
VCID-ch7g-e8bv-mkck |
| vulnerability_id |
VCID-ch7g-e8bv-mkck |
| summary |
NiceGUI is a Python-based UI framework. The ui.markdown() component uses the markdown2 library to convert markdown content to HTML, which is then rendered via innerHTML. By default, markdown2 allows raw HTML to pass through unchanged. This means that if an application renders user-controlled content through ui.markdown(), an attacker can inject malicious HTML containing JavaScript event handlers. Unlike other NiceGUI components that render HTML (ui.html(), ui.chat_message(), ui.interactive_image()), the ui.markdown() component does not provide or require a sanitize parameter, leaving applications vulnerable to XSS attacks. This vulnerability is fixed in 3.7.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-25516, GHSA-v82v-c5x8-w282
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ch7g-e8bv-mkck |
|
| 5 |
| url |
VCID-cw8a-xpmx-kfh9 |
| vulnerability_id |
VCID-cw8a-xpmx-kfh9 |
| summary |
NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames containing ../ sequences allow attackers to write files outside intended directories, with potential for remote code execution through application file overwrites in vulnerable deployment patterns. This design creates a prevalent security footgun affecting applications following common community patterns. Note: Exploitation requires application code incorporating file.name into filesystem paths without sanitization. Applications using fixed paths, generated filenames, or explicit sanitization are not affected. This vulnerability is fixed in 3.7.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-25732, GHSA-9ffm-fxg3-xrhh, PYSEC-2026-95
|
| risk_score |
10.0 |
| exploitability |
2.0 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cw8a-xpmx-kfh9 |
|
| 6 |
| url |
VCID-mtpf-xq2a-9ubk |
| vulnerability_id |
VCID-mtpf-xq2a-9ubk |
| summary |
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version 3.4.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-66645, GHSA-hxp3-63hc-5366
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mtpf-xq2a-9ubk |
|
| 7 |
| url |
VCID-p7ts-gwhs-bqda |
| vulnerability_id |
VCID-p7ts-gwhs-bqda |
| summary |
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG <foreignObject> tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-66470, GHSA-2m4f-cg75-76w2
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-p7ts-gwhs-bqda |
|
| 8 |
| url |
VCID-wgp7-za8k-bqaq |
| vulnerability_id |
VCID-wgp7-za8k-bqaq |
| summary |
NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements (`Element.run_method()`, `AgGrid.run_grid_method()`, `EChart.run_chart_method()`, and others) use an `eval()` fallback in the JavaScript-side `runMethod()` function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser. Additionally, `Element.run_method()` and `Element.get_computed_prop()` used string interpolation instead of `json.dumps()` for the method/property name, allowing quote injection to break out of the intended string context. Version 3.8.0 contains a fix. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-27156, GHSA-78qv-3mpx-9cqq
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wgp7-za8k-bqaq |
|
| 9 |
| url |
VCID-yjjx-r1vh-d3gn |
| vulnerability_id |
VCID-yjjx-r1vh-d3gn |
| summary |
NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (\) in the upload filename. Applications that construct file paths using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. This vulnerability is fixed in 3.10.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-39844, GHSA-w8wv-vfpc-hw2w
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-yjjx-r1vh-d3gn |
|
|
|---|