Vulnerabilities

TI-2026-28726 CVE-2026-39844 · GHSA-w8wv-vfpc-hw2w

NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization

LOW 33

NiceGUI is a Python-based UI framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00385 Published 2026-04-08 Fixed in 3.10.0 CWE-22

TI-2026-25742 CVE-2026-33332 · GHSA-w5g8-5849-vj76

NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

LOW 37

NiceGUI is a Python-based UI framework.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00622 Published 2026-03-24 Fixed in 3.9.0 CWE-20

TI-2026-21605 CVE-2026-27156 · GHSA-78qv-3mpx-9cqq

NiceGUI has XSS via Code Injection

LOW 27

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00196 Published 2026-02-24 Fixed in 3.8.0 CWE-79

TI-2026-20625 CVE-2026-25516 · GHSA-v82v-c5x8-w282

NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content

LOW 27

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00276 Published 2026-02-06 Fixed in 3.7.0 CWE-79

TI-2026-20800 CVE-2026-25732 · GHSA-9ffm-fxg3-xrhh

NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write

MEDIUM 45

NiceGUI is a Python-based UI framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03379 Published 2026-02-06 Fixed in 3.7.0 CWE-22

TI-2026-17575 CVE-2026-21874 · GHSA-mp55-g7pj-rvm2

NiceGUI has Redis connection leak via tab storage causes service degradation

MEDIUM 63

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00554 Published 2026-01-08 Fixed in 3.5.0 CWE-772

TI-2026-17574 CVE-2026-21873 · GHSA-mhpg-c27v-6mxr

Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`

HIGH 71

NiceGUI is a Python-based UI framework.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0026 Published 2026-01-08 Fixed in 3.5.0 CWE-79

TI-2026-17573 CVE-2026-21872 · GHSA-m7j5-rq9j-6jj9

NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

MEDIUM 60

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00271 Published 2026-01-08 Fixed in 3.5.0 CWE-79

TI-2026-17572 CVE-2026-21871 · GHSA-7grm-h62g-5m97

NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

MEDIUM 60

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00273 Published 2026-01-08 Fixed in 3.5.0 CWE-79

TI-2025-41029 CVE-2025-66645 · GHSA-hxp3-63hc-5366

NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading

HIGH 72

NiceGUI is a Python-based UI framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0112 Published 2025-12-09 Fixed in 3.4.0 CWE-22

TI-2025-40897 CVE-2025-66470 · GHSA-2m4f-cg75-76w2

NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

MEDIUM 60

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00254 Published 2025-12-09 Fixed in 3.4.0 CWE-79

TI-2025-40896 CVE-2025-66469 · GHSA-72qc-wxch-74mg

NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection

MEDIUM 60

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00295 Published 2025-12-08 Fixed in 3.4.0 CWE-79

Vulnerabilities

Filters