{"kind": "product", "path": "vulns/pypi/nicegui", "name": "nicegui", "product": "nicegui", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-45554", "noindex": false, "published": "2026-06-02T15:35:07.125Z", "modified": "2026-06-02T18:03:46.033Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00343, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-45554", "title": "NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes", "description": "NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. This issue has been patched in version 3.12.0.", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-pq7c-x8g4-rvp6", "https://github.com/zauberzeug/nicegui/releases/tag/v3.12.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-45554"], "fixes": ["3.12.0"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-45553", "noindex": false, "published": "2026-06-02T15:34:39.897Z", "modified": "2026-06-03T13:49:28.209Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00255, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-45553", "title": "NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()", "description": "NiceGUI is a Python-based UI framework. Prior to version 3.12.0, ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives. When a NiceGUI application passes attacker-controlled content to ui.restructured_text(), an attacker can use standard Docutils directives (include, csv-table with :file:, raw with :file:) to read local files readable by the NiceGUI server process. Applications that only pass trusted static strings to ui.restructured_text() are not affected. This issue has been patched in version 3.12.0.", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-jfrm-rx66-g536", "https://github.com/zauberzeug/nicegui/releases/tag/v3.12.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-45553"], "fixes": ["3.12.0"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-39844", "noindex": false, "published": "2026-04-08T20:13:31.935Z", "modified": "2026-04-09T16:17:11.748Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00371, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-39844", "title": "NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization", "description": "NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (\\) in the upload filename. Applications that construct file paths using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. This vulnerability is fixed in 3.10.0.", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-w8wv-vfpc-hw2w", "https://github.com/zauberzeug/nicegui/commit/d38a702e3af2da5b0708f689be8d71413fc77056", "https://github.com/zauberzeug/nicegui/releases/tag/v3.10.0"], "fixes": ["3.10.0"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-33332", "noindex": false, "published": "2026-03-24T19:20:53.386Z", "modified": "2026-03-25T16:19:18.462Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00622, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-33332", "title": "NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion", "description": "NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and force the server to load entire files into memory at once. With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service. This issue has been patched in version 3.9.0.", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-w5g8-5849-vj76", "https://github.com/zauberzeug/nicegui/commit/9026962b8c4f3f225c98b2fbc35aa6b60cb3495b", "https://github.com/zauberzeug/nicegui/releases/tag/v3.9.0"], "fixes": ["3.9.0"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-27156", "noindex": false, "published": "2026-02-24T17:00:21.628Z", "modified": "2026-02-26T21:33:40.507Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00196, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-27156", "title": "NiceGUI has XSS via Code Injection", "description": "NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements (`Element.run_method()`, `AgGrid.run_grid_method()`, `EChart.run_chart_method()`, and others) use an `eval()` fallback in the JavaScript-side `runMethod()` function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser. Additionally, `Element.run_method()` and `Element.get_computed_prop()` used string interpolation instead of `json.dumps()` for the method/property name, allowing quote injection to break out of the intended string ", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-78qv-3mpx-9cqq", "https://github.com/zauberzeug/nicegui/commit/1861f59cc374ca0dc9d970b157ef3774720f8dbf", "https://nvd.nist.gov/vuln/detail/CVE-2026-27156"], "fixes": ["3.8.0"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-25516", "noindex": false, "published": "2026-02-06T21:12:19.501Z", "modified": "2026-02-09T15:27:15.351Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.0028, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-25516", "title": "NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content", "description": "NiceGUI is a Python-based UI framework. The ui.markdown() component uses the markdown2 library to convert markdown content to HTML, which is then rendered via innerHTML. By default, markdown2 allows raw HTML to pass through unchanged. This means that if an application renders user-controlled content through ui.markdown(), an attacker can inject malicious HTML containing JavaScript event handlers. Unlike other NiceGUI components that render HTML (ui.html(), ui.chat_message(), ui.interactive_image()), the ui.markdown() component does not provide or require a sanitize parameter, leaving applications vulnerable to XSS attacks. This vulnerability ", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-v82v-c5x8-w282", "https://github.com/zauberzeug/nicegui/commit/f1f7533577875af7d23f161ed3627f73584cb561", "https://nvd.nist.gov/vuln/detail/CVE-2026-25516"], "fixes": ["3.7.0"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-25732", "noindex": false, "published": "2026-02-06T21:09:58.389Z", "modified": "2026-02-09T15:27:21.089Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.03429, "kev": false, "exploits": ["exploitdb"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-25732", "title": "NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write", "description": "NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames containing ../ sequences allow attackers to write files outside intended directories, with potential for remote code execution through application file overwrites in vulnerable deployment patterns. This design creates a prevalent security footgun affecting applications following common community patterns. Note: Exploitation requires application code incorporating file.name into filesystem pat", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-9ffm-fxg3-xrhh", "https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L110-L115", "https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L79-L82"], "fixes": ["3.7.0"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-21874", "noindex": false, "published": "2026-01-08T09:50:47.247Z", "modified": "2026-01-08T14:43:50.018Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00554, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-21874", "title": "NiceGUI has Redis connection leak via tab storage causes service degradation", "description": "NiceGUI is a Python-based UI framework. From versions v2.10.0 to 3.4.1, an unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connections are never released, leading to service degradation when Redis hits its connection limit. NiceGUI continues accepting new connections - errors are logged but the app stays up with broken storage functionality. This issue has been patched in version 3.5.0.", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mp55-g7pj-rvm2", "https://github.com/zauberzeug/nicegui/commit/6c52eb2c90c4b67387c025b29646b4bc1578eb83", "https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0"], "fixes": ["3.5.0"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-21873", "noindex": false, "published": "2026-01-08T09:50:23.361Z", "modified": "2026-01-08T15:11:24.092Z", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "severity": "high", "epss": 0.0026, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-21873", "title": "Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`", "description": "NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site, using an iframe. This issue has been patched in version 3.5.0.", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mhpg-c27v-6mxr", "https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-21873"], "fixes": ["3.5.0"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-21872", "noindex": false, "published": "2026-01-08T09:50:02.801Z", "modified": "2026-01-08T15:13:11.652Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00271, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-21872", "title": "NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links", "description": "NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the click event listener used by ui.sub_pages, combined with attacker-controlled link rendering on the page, causes XSS when the user actively clicks on the link. This issue has been patched in version 3.5.0.", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-m7j5-rq9j-6jj9", "https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-21872"], "fixes": ["3.5.0"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-21871", "noindex": false, "published": "2026-01-08T09:49:55.136Z", "modified": "2026-01-08T15:15:16.509Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00273, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-21871", "title": "NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()", "description": "NiceGUI is a Python-based UI framework. From versions 2.13.0 to 3.4.1, there is a XSS risk in NiceGUI when developers pass attacker-controlled strings into ui.navigate.history.push() or ui.navigate.history.replace(). These helpers are documented as History API wrappers for updating the browser URL without page reload. However, if the URL argument is embedded into generated JavaScript without proper escaping, a crafted payload can break out of the intended string context and execute arbitrary JavaScript in the victim’s browser. Applications that do not pass untrusted input into ui.navigate.history.push/replace are not affected. This issue has ", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-7grm-h62g-5m97", "https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-21871"], "fixes": ["3.5.0"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-66645", "noindex": false, "published": "2025-12-09T21:41:32.049Z", "modified": "2025-12-10T16:50:41.291Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.0112, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-66645", "title": "NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading", "description": "NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to  directory traversal through the App.add_media_files() function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version 3.4.0.", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-hxp3-63hc-5366", "https://github.com/zauberzeug/nicegui/commit/a1b89e2a24e1911a40389ace2153a37f4eea92a9", "https://nvd.nist.gov/vuln/detail/CVE-2025-66645"], "fixes": ["3.4.0"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-66470", "noindex": false, "published": "2025-12-09T00:11:14.690Z", "modified": "2025-12-09T16:03:45.875Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00254, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-66470", "title": "NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content", "description": "NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG <foreignObject> tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0.", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-2m4f-cg75-76w2", "https://github.com/zauberzeug/nicegui/commit/58ad0b36e19922de16bbc79ea3ddd29851b1a3e3", "https://nvd.nist.gov/vuln/detail/CVE-2025-66470"], "fixes": ["3.4.0"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-66469", "noindex": false, "published": "2025-12-08T23:54:37.955Z", "modified": "2025-12-09T16:03:54.125Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00275, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-66469", "title": "NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection", "description": "NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.add_css, ui.add_scss, and ui.add_sass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended <style> or <script> tags by injecting closing tags (e.g., </style> or </script>), allowing for the execution of arbitrary JavaScript. This issue is fixed in version 3.4.0.", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-72qc-wxch-74mg", "https://github.com/zauberzeug/nicegui/commit/a8fd25b7d5e23afb1952d0f60a1940e18b5f1ca8", "https://nvd.nist.gov/vuln/detail/CVE-2025-66469"], "fixes": ["3.4.0"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-53354", "noindex": false, "published": "2025-10-03T19:32:21.521Z", "modified": "2025-10-03T19:42:40.273Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00204, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-53354", "title": "NiceGUI is vulnerable to Reflected XSS attack", "description": "NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting (XSS) when developers render unescaped user input into the DOM using ui.html(). NiceGUI did not enforce HTML or JavaScript sanitization, so applications that directly combine components like ui.input() with ui.html() or  ui.chat_message with HTML content without escaping may allow attackers to execute arbitrary JavaScript in the user’s browser. Applications that do not pass untrusted input into ui.html() are not affected. This issue is fixed in version 3.0.0.", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-8c95-hpq2-w46f", "https://github.com/zauberzeug/nicegui/commit/4673dc35c94a0c7339e2164378b0977332e60775", "https://nvd.nist.gov/vuln/detail/CVE-2025-53354"], "fixes": ["3.0.0"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-21618", "noindex": false, "published": "2025-01-06T16:30:11.349Z", "modified": "2025-01-06T16:47:43.489Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00392, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-21618", "title": "NiceGUI On Air authentication issue", "description": "NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in incognito mode. This vulnerability is fixed in 2.9.1.", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-v6jv-p6r8-j78w", "https://github.com/zauberzeug/nicegui/commit/1621a4ba6a06676b8094362d36623551e651adc1", "https://nvd.nist.gov/vuln/detail/CVE-2025-21618"], "fixes": ["2.9.1"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-32005", "noindex": false, "published": "2024-04-12T20:38:51.147Z", "modified": "2024-09-06T17:57:52.461Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "severity": "high", "epss": 0.0076, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-32005", "title": "Local File Inclusion in NiceGUI leaflet component", "description": "NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the `/_nicegui/{__version__}/resources/{key}/{path:path}` route. As a result any file on the backend filesystem which the web server has access to can be read by an attacker with access to the NiceUI leaflet website. This vulnerability has been addressed in version 1.4.21. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "references": ["https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mwc7-64wg-pgvj", "https://github.com/zauberzeug/nicegui/commit/ed12eb14f2a6c48b388a05c04b3c5a107ea9d330", "https://huntr.com/bounties/29ec621a-bd69-4225-ab0f-5bb8a1d10c67"], "fixes": ["1.4.21"], "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}]}], "total": 17, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "nicegui", "path": "vulns/pypi/nicegui", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-06-03T13:49:28.209Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}