Skip to content
OpenAdvisories

Package · PyPI

nicegui

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.5
    CVE-2026-45553

    NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()

    NiceGUI is a Python-based UI framework. Prior to version 3.12.0, ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives. When a NiceGUI application passes attacker-controlled content to ui.restruc…

    zauberzeug nicegui nicegui PyPI
  • High 7.5
    CVE-2026-25732 Public exploit

    NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write

    NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames cont…

    zauberzeug nicegui nicegui PyPI
  • High 7.2
    CVE-2026-21873

    Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`

    NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-sit…

    zauberzeug nicegui nicegui PyPI
  • High 7.5
    CVE-2025-66645 Public exploit

    NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading

    NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version …

    zauberzeug nicegui nicegui PyPI
  • High 7.5
    CVE-2025-21618

    NiceGUI On Air authentication issue

    NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in incognito mode. This vulnerability is fixed in 2.9.1.

    zauberzeug nicegui nicegui PyPI
  • High 8.2
    CVE-2024-32005

    Local File Inclusion in NiceGUI leaflet component

    NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the `/_nicegui/{__version__}/resources/{key}/{path:path}` route. As a result any file on the backend f…

    zauberzeug nicegui nicegui PyPI