| NiceGUI allows potential access to local file systemCVE-2024-32005 · GHSA-MWC7-64WG-PGVJVersion ranges need review. |
nicegui |
PyPI |
High
|
Fix reported |
|
| NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routesCVE-2026-45554 · GHSA-PQ7C-X8G4-RVP6Version ranges need review. |
nicegui |
PyPI |
Medium
|
Fix reported |
|
| NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()CVE-2026-45553 · GHSA-JFRM-RX66-G536Version ranges need review. |
nicegui |
PyPI |
High
|
Fix reported |
|
| NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on WindowsCVE-2026-39844 · GHSA-W8WV-VFPC-HW2WVersion ranges need review. |
nicegui |
PyPI |
Medium
|
Fix reported |
|
| NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustionCVE-2026-33332 · GHSA-W5G8-5849-VJ76Version ranges need review. |
nicegui |
PyPI |
Medium
|
Fix reported |
|
| NiceGUI vulnerable to XSS via Code Injection during client-side element function executionCVE-2026-27156 · GHSA-78QV-3MPX-9CQQVersion ranges need review. |
nicegui |
PyPI |
Medium
|
Fix reported |
|
| NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML contentCVE-2026-25516 · GHSA-V82V-C5X8-W282Version ranges need review. |
nicegui |
PyPI |
Medium
|
Fix reported |
|
| NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSSCVE-2026-21873 · GHSA-MHPG-C27V-6MXRVersion ranges need review. |
nicegui |
PyPI |
High
|
Fix reported |
|
| NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()CVE-2026-21871 · GHSA-7GRM-H62G-5M97Version ranges need review. |
nicegui |
PyPI |
Medium
|
Fix reported |
|
| NiceGUI has a path traversal in app.add_media_files() allows arbitrary file readCVE-2025-66645 · GHSA-HXP3-63HC-5366Version ranges need review. |
nicegui |
PyPI |
High
|
Fix reported |
|
| NiceGUI has a Reflected XSSCVE-2025-53354 · GHSA-8C95-HPQ2-W46FVersion ranges need review. |
nicegui |
PyPI |
Medium
|
Fix reported |
|
| NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided linksCVE-2026-21872 · GHSA-M7J5-RQ9J-6JJ9Version ranges need review. |
nicegui |
PyPI |
Medium
|
Fix reported |
|
| NiceGUI On Air authentication issueCVE-2025-21618 · GHSA-V6JV-P6R8-J78WVersion ranges need review. |
nicegui |
PyPI |
High
|
Fix reported |
|
| NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG contentCVE-2025-66470 · GHSA-2M4F-CG75-76W2Version ranges need review. |
nicegui |
PyPI |
Medium
|
Fix reported |
|
| NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style InjectionCVE-2025-66469 · GHSA-72QC-WXCH-74MGVersion ranges need review. |
nicegui |
PyPI |
Medium
|
Fix reported |
|
| NiceGUI has Redis connection leak via tab storage causes service degradationCVE-2026-21874 · GHSA-MP55-G7PJ-RVM2Version ranges need review. |
nicegui |
PyPI |
Medium
|
Fix reported |
|
| NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File WriteCVE-2026-25732 · GHSA-9FFM-FXG3-XRHHVersion ranges need review. |
nicegui |
PyPI |
High
|
Fix reported |
|
