TI-2024-21104 Aliases CVE-2024-32005 GHSA-mwc7-64wg-pgvj

Local File Inclusion in NiceGUI leaflet component

HIGH 75CWE-22Published 2024-04-12 · Updated 2024-09-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the `/_nicegui/{__version__}/resources/{key}/{path:path}` route. As a result any file on the backend filesystem which the web server has access to can be read by an attacker with access to the NiceUI leaflet website. This vulnerability has been addressed in version 1.4.21. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0076 55th percentileScored 2026-11-07

Fix Fixed nicegui (zauberzeug): 1.4.21nicegui (PyPI): 1.4.21

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
zauberzeug	nicegui	1.4.6 to before 1.4.21	1.4.21	Patch available	CNA
—	nicegui (PyPI)	1.4.6 to before 1.4.21	1.4.21	Patch available	GHSA-mwc7-64wg-pgvj

nicegui Vendorzauberzeug Affected 1.4.6 to before 1.4.21 Fixed in 1.4.21 Patch available CNA
nicegui (PyPI) Vendor— Affected 1.4.6 to before 1.4.21 Fixed in 1.4.21 Patch available GHSA-mwc7-64wg-pgvj

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:zauberzeug:nicegui::::::::	—	—	zauberzeug

cpe:2.3:a:zauberzeug:nicegui:*:*:*:*:*:*:*:* Versions — — ·zauberzeug

Remediation

Fix · CNA nicegui (zauberzeug) Fixed in 1.4.21
Fix · GHSA-mwc7-64wg-pgvj nicegui (PyPI) Fixed in 1.4.21 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-32005
2026-10-03 Alias added: GHSA-mwc7-64wg-pgvj

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-32005

Other 4

TI-2025-41029 NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading CVSS 3.1HIGH 7.5
TI-2025-15578 NiceGUI On Air authentication issue CVSS 3.1HIGH 7.5
TI-2026-17574 Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages` CVSS 3.1HIGH 7.2
TI-2026-17575 NiceGUI has Redis connection leak via tab storage causes service degradation CVSS 3.1MEDIUM 5.3
TI-2026-17573 NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links CVSS 3.1MEDIUM 6.1
TI-2026-17572 NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace() CVSS 3.1MEDIUM 6.1

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences