Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

nicegui — Vulnerabilities & Security Advisories 17

All 17 CVE vulnerabilities found in nicegui, with AI-generated Chinese analysis, references, and POCs.

This page aggregates reported vulnerabilities for the NiceGUI application framework, a Python library for building web-based user interfaces. It collects security advisories related to the NiceGUI product, covering historical and current defects identified in its codebase. The dataset spans multiple years of reported issues, focusing primarily on common weakness classes such as injection flaws, authentication bypasses, and insecure dependencies. Readers can use this repository to track the vendor's security posture over time, analyze specific weakness patterns within the NiceGUI codebase, and review the product's complete vulnerability history. The aggregation supports security teams, developers, and auditors who need a consolidated view of known risks associated with this specific technology. By centralizing these reports, the page facilitates impact assessment, regression testing, and patch management decisions for organizations utilizing NiceGUI in production environments. The content is updated as new findings are verified and published by the maintainers and the broader security community.

Vendor: zauberzeug

CVE ID Title CVSS Severity Published
CVE-2026-45554 NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes CWE-248 5.3 Medium 2026-06-02
CVE-2026-45553 NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text() CWE-200 7.5 High 2026-06-02
CVE-2026-39844 NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization CWE-22 5.9 Medium 2026-04-08
CVE-2026-33332 NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion CWE-20 7.5 - 2026-03-24
CVE-2026-27156 NiceGUI has XSS via Code Injection CWE-79 6.1 Medium 2026-02-24
CVE-2026-25516 NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content CWE-79 6.1 Medium 2026-02-06
CVE-2026-25732 NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write CWE-22 7.5 High 2026-02-06
CVE-2026-21874 NiceGUI has Redis connection leak via tab storage causes service degradation CWE-772 5.3 Medium 2026-01-08
CVE-2026-21873 Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages` CWE-79 7.2 High 2026-01-08
CVE-2026-21872 NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links CWE-79 6.1 Medium 2026-01-08
CVE-2026-21871 NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace() CWE-79 6.1 Medium 2026-01-08
CVE-2025-66645 NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading CWE-22 7.5 High 2025-12-09
CVE-2025-66470 NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content CWE-79 6.1 Medium 2025-12-09
CVE-2025-66469 NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection CWE-79 6.1 Medium 2025-12-08
CVE-2025-53354 NiceGUI is vulnerable to Reflected XSS attack CWE-79 6.1 Medium 2025-10-03
CVE-2025-21618 NiceGUI On Air authentication issue CWE-287 7.5 High 2025-01-06
CVE-2024-32005 Local File Inclusion in NiceGUI leaflet component CWE-23 8.2 High 2024-04-12

All 17 known CVE vulnerabilities affecting nicegui with full Chinese analysis, references, and POCs where available.