# nicegui (PyPI) vulnerabilities 17 known vulnerabilities (6 high, 11 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.0.0 (Nov 4, 2026): no advisory affects it - Newest unaffected release: 4.0.0 (Nov 4, 2026), the latest release - Weekly downloads: 291K - Dependents: 263 - Releases: 318 since 0.1.0 (May 14, 2021) - Registry: https://pypi.org/project/nicegui/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-45554: 0.1.0 to 3.11.1 (3.12.0 is outside it) - CVE-2026-45553: 0.1.0 to 3.11.1 (3.12.0 is outside it) - CVE-2026-39844: 0.1.0 to 3.9.0 (3.10.0 is outside it) - CVE-2026-33332: 0.1.0 to 3.8.0 (3.9.0 is outside it) - CVE-2026-27156: 0.1.0 to 3.7.1 (3.8.0 is outside it) - CVE-2026-25516: 0.1.0 to 3.6.1 (3.7.0 is outside it) - CVE-2026-25732: 0.1.0 to 3.6.1 (3.7.0 is outside it) - CVE-2026-21874: 2.10.0 to 3.4.1 (3.5.0 is outside it) - CVE-2026-21873: 2.22.0 to 3.4.1 (3.5.0 is outside it) - CVE-2026-21872: 2.22.0 to 3.4.1 (3.5.0 is outside it) - CVE-2026-21871: 2.13.0 to 3.4.1 (3.5.0 is outside it) - CVE-2025-66645: 0.1.0 to 3.3.1 (3.4.0 is outside it) - CVE-2025-66470: 0.1.0 to 3.3.1 (3.4.0 is outside it) - CVE-2025-66469: 0.1.0 to 3.3.1 (3.4.0 is outside it) - CVE-2025-53354: 0.1.0 to 3.0.0rc1 (3.0.0 is outside it) - CVE-2025-21618: 0.1.0 to 2.9.0 (2.9.1 is outside it) - CVE-2024-32005: 1.4.6 to 1.4.20 (1.4.21 is outside it) ## Advisories (17) ### [CVE-2026-45554](https://cve.now/CVE-2026-45554): NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes - Severity: Medium 5.3 - Published: Jun 2, 2026 - Affected: fixed in 3.12.0. - Fixed in 3.12.0 (released May 12, 2026, 21 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-45553](https://cve.now/CVE-2026-45553): NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured\_text() - Severity: High 7.5 - Published: Jun 2, 2026 - Affected: fixed in 3.12.0. - Fixed in 3.12.0 (released May 12, 2026, 21 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-39844](https://cve.now/CVE-2026-39844): NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization - Severity: Medium 5.9 - Published: Apr 8, 2026 - Affected: fixed in 3.10.0. - Fixed in 3.10.0 (released Apr 7, 2026, 1 day before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-33332](https://cve.now/CVE-2026-33332): NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion - Severity: Medium 6.9 - Published: Mar 24, 2026 - Affected: fixed in 3.9.0. - Fixed in 3.9.0 (released Mar 19, 2026, 5 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-27156](https://cve.now/CVE-2026-27156): NiceGUI has XSS via Code Injection - Severity: Medium 6.1 - Published: Feb 24, 2026 - Affected: fixed in 3.8.0. - Fixed in 3.8.0 (released Feb 24, 2026, the day of disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-25516](https://cve.now/CVE-2026-25516): NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content - Severity: Medium 6.1 - Published: Feb 6, 2026 - Affected: fixed in 3.7.0. - Fixed in 3.7.0 (released Feb 5, 2026, 1 day before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-25732](https://cve.now/CVE-2026-25732): NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write - Severity: High 7.5 - Published: Feb 6, 2026 - Affected: fixed in 3.7.0. - Fixed in 3.7.0 (released Feb 5, 2026, 1 day before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-21874](https://cve.now/CVE-2026-21874): NiceGUI has Redis connection leak via tab storage causes service degradation - Severity: Medium 5.3 - Published: Jan 8, 2026 - Affected: from 2.10.0, fixed in 3.5.0. - Fixed in 3.5.0 (released Jan 8, 2026, the day of disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-21873](https://cve.now/CVE-2026-21873): Zero-click XSS in all NiceGUI apps which uses \`ui.sub\_pages\` - Severity: High 7.2 - Published: Jan 8, 2026 - Affected: from 2.22.0, fixed in 3.5.0. - Fixed in 3.5.0 (released Jan 8, 2026, the day of disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-21872](https://cve.now/CVE-2026-21872): NiceGUI apps are vulnerable to XSS which uses \`ui.sub\_pages\` and render arbitrary user-provided links - Severity: Medium 6.1 - Published: Jan 8, 2026 - Affected: from 2.22.0, fixed in 3.5.0. - Fixed in 3.5.0 (released Jan 8, 2026, the day of disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-21871](https://cve.now/CVE-2026-21871): NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace() - Severity: Medium 6.1 - Published: Jan 8, 2026 - Affected: from 2.13.0, fixed in 3.5.0. - Fixed in 3.5.0 (released Jan 8, 2026, the day of disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2025-66645](https://cve.now/CVE-2025-66645): NiceGUI Path Traversal Vulnerability in app.add\_media\_files() Allows Arbitrary File Reading - Severity: High 7.5 - Published: Dec 9, 2025 - Affected: fixed in 3.4.0. - Fixed in 3.4.0 (released Dec 8, 2025, 1 day before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2025-66470](https://cve.now/CVE-2025-66470): NiceGUI Stored/Reflected XSS in ui.interactive\_image via unsanitized SVG content - Severity: Medium 6.1 - Published: Dec 9, 2025 - Affected: fixed in 3.4.0. - Fixed in 3.4.0 (released Dec 8, 2025, 1 day before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2025-66469](https://cve.now/CVE-2025-66469): NiceGUI Reflected XSS in ui.add\_css, ui.add\_scss, and ui.add\_sass via Style Injection - Severity: Medium 6.1 - Published: Dec 8, 2025 - Affected: fixed in 3.4.0. - Fixed in 3.4.0 (released Dec 8, 2025, the day of disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2025-53354](https://cve.now/CVE-2025-53354): NiceGUI is vulnerable to Reflected XSS attack - Severity: Medium 6.1 - Published: Oct 3, 2025 - Affected: fixed in 3.0.0. - Fixed in 3.0.0 (released Oct 3, 2025, the day of disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2025-21618](https://cve.now/CVE-2025-21618): NiceGUI On Air authentication issue - Severity: High 7.5 - Published: Jan 6, 2025 - Affected: fixed in 2.9.1. - Fixed in 2.9.1 (released Jan 6, 2025, the day of disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2024-32005](https://cve.now/CVE-2024-32005): Local File Inclusion in NiceGUI leaflet component - Severity: High 8.2 - Published: Apr 12, 2024 - Affected: from 1.4.6, fixed in 1.4.21. - Fixed in 1.4.21 (released Apr 12, 2024, the day of disclosure). - The latest release, 4.0.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/nicegui Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.