Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

nicegui

17 known vulnerabilities (6 high, 11 medium), with the versions each affects and the releases that fix them.

Latest release
4.0.0 (Nov 4, 2026): no advisory affects it
Newest unaffected release
4.0.0 (Nov 4, 2026), the latest release
Advisories
17 · 6 high, 11 medium
Weekly downloads
291K
Dependents
263
Releases
318 since 0.1.0 (May 14, 2021)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 17 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 17

  • CVE-2026-45554Medium 5.3

    NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes

    Affected: fixed in 3.12.0.

    Fixed in 3.12.0 (released May 12, 2026, 21 days before disclosure).

    The latest release, 4.0.0, is not affected.

  • NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()

    Affected: fixed in 3.12.0.

    Fixed in 3.12.0 (released May 12, 2026, 21 days before disclosure).

    The latest release, 4.0.0, is not affected.

  • CVE-2026-39844Medium 5.9

    NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization

    Affected: fixed in 3.10.0.

    Fixed in 3.10.0 (released Apr 7, 2026, 1 day before disclosure).

    The latest release, 4.0.0, is not affected.

  • CVE-2026-33332Medium 6.9

    NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

    Affected: fixed in 3.9.0.

    Fixed in 3.9.0 (released Mar 19, 2026, 5 days before disclosure).

    The latest release, 4.0.0, is not affected.

  • CVE-2026-27156Medium 6.1

    NiceGUI has XSS via Code Injection

    Affected: fixed in 3.8.0.

    Fixed in 3.8.0 (released Feb 24, 2026, the day of disclosure).

    The latest release, 4.0.0, is not affected.

  • CVE-2026-25516Medium 6.1

    NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content

    Affected: fixed in 3.7.0.

    Fixed in 3.7.0 (released Feb 5, 2026, 1 day before disclosure).

    The latest release, 4.0.0, is not affected.

  • NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write

    Affected: fixed in 3.7.0.

    Fixed in 3.7.0 (released Feb 5, 2026, 1 day before disclosure).

    The latest release, 4.0.0, is not affected.

  • CVE-2026-21874Medium 5.3

    NiceGUI has Redis connection leak via tab storage causes service degradation

    Affected: from 2.10.0, fixed in 3.5.0.

    Fixed in 3.5.0 (released Jan 8, 2026, the day of disclosure).

    The latest release, 4.0.0, is not affected.

  • Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`

    Affected: from 2.22.0, fixed in 3.5.0.

    Fixed in 3.5.0 (released Jan 8, 2026, the day of disclosure).

    The latest release, 4.0.0, is not affected.

  • CVE-2026-21872Medium 6.1

    NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

    Affected: from 2.22.0, fixed in 3.5.0.

    Fixed in 3.5.0 (released Jan 8, 2026, the day of disclosure).

    The latest release, 4.0.0, is not affected.

  • CVE-2026-21871Medium 6.1

    NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

    Affected: from 2.13.0, fixed in 3.5.0.

    Fixed in 3.5.0 (released Jan 8, 2026, the day of disclosure).

    The latest release, 4.0.0, is not affected.

  • NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading

    Affected: fixed in 3.4.0.

    Fixed in 3.4.0 (released Dec 8, 2025, 1 day before disclosure).

    The latest release, 4.0.0, is not affected.

  • CVE-2025-66470Medium 6.1

    NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

    Affected: fixed in 3.4.0.

    Fixed in 3.4.0 (released Dec 8, 2025, 1 day before disclosure).

    The latest release, 4.0.0, is not affected.

  • CVE-2025-66469Medium 6.1

    NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection

    Affected: fixed in 3.4.0.

    Fixed in 3.4.0 (released Dec 8, 2025, the day of disclosure).

    The latest release, 4.0.0, is not affected.

  • CVE-2025-53354Medium 6.1

    NiceGUI is vulnerable to Reflected XSS attack

    Affected: fixed in 3.0.0.

    Fixed in 3.0.0 (released Oct 3, 2025, the day of disclosure).

    The latest release, 4.0.0, is not affected.

Show all 17 advisoriesShow fewer advisories

  • NiceGUI On Air authentication issue

    Affected: fixed in 2.9.1.

    Fixed in 2.9.1 (released Jan 6, 2025, the day of disclosure).

    The latest release, 4.0.0, is not affected.

  • Local File Inclusion in NiceGUI leaflet component

    Affected: from 1.4.6, fixed in 1.4.21.

    Fixed in 1.4.21 (released Apr 12, 2024, the day of disclosure).

    The latest release, 4.0.0, is not affected.