Vulnerabilities

TI-2026-33303 CVE-2026-45554 · GHSA-pq7c-x8g4-rvp6

NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes

LOW 30

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00343 Published 2026-06-02 Fixed in 3.12.0 CWE-248

TI-2026-33302 CVE-2026-45553 · GHSA-jfrm-rx66-g536

NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()

LOW 38

NiceGUI is a Python-based UI framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00255 Published 2026-06-02 Fixed in 3.12.0 CWE-200

TI-2026-28726 CVE-2026-39844 · GHSA-w8wv-vfpc-hw2w

NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization

LOW 33

NiceGUI is a Python-based UI framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00385 Published 2026-04-08 Fixed in 3.10.0 CWE-22

TI-2026-25742 CVE-2026-33332 · GHSA-w5g8-5849-vj76

NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

LOW 37

NiceGUI is a Python-based UI framework.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00622 Published 2026-03-24 Fixed in 3.9.0 CWE-20

TI-2026-21605 CVE-2026-27156 · GHSA-78qv-3mpx-9cqq

NiceGUI has XSS via Code Injection

LOW 27

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00196 Published 2026-02-24 Fixed in 3.8.0 CWE-79

TI-2026-20625 CVE-2026-25516 · GHSA-v82v-c5x8-w282

NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content

LOW 27

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00276 Published 2026-02-06 Fixed in 3.7.0 CWE-79

TI-2026-20800 CVE-2026-25732 · GHSA-9ffm-fxg3-xrhh

NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write

MEDIUM 45

NiceGUI is a Python-based UI framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03379 Published 2026-02-06 Fixed in 3.7.0 CWE-22

TI-2026-17575 CVE-2026-21874 · GHSA-mp55-g7pj-rvm2

NiceGUI has Redis connection leak via tab storage causes service degradation

MEDIUM 63

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00554 Published 2026-01-08 Fixed in 3.5.0 CWE-772

TI-2026-17574 CVE-2026-21873 · GHSA-mhpg-c27v-6mxr

Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`

HIGH 71

NiceGUI is a Python-based UI framework.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0026 Published 2026-01-08 Fixed in 3.5.0 CWE-79

TI-2026-17573 CVE-2026-21872 · GHSA-m7j5-rq9j-6jj9

NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

MEDIUM 60

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00271 Published 2026-01-08 Fixed in 3.5.0 CWE-79

TI-2026-17572 CVE-2026-21871 · GHSA-7grm-h62g-5m97

NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

MEDIUM 60

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00273 Published 2026-01-08 Fixed in 3.5.0 CWE-79

TI-2025-41029 CVE-2025-66645 · GHSA-hxp3-63hc-5366

NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading

HIGH 72

NiceGUI is a Python-based UI framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0112 Published 2025-12-09 Fixed in 3.4.0 CWE-22

TI-2025-40897 CVE-2025-66470 · GHSA-2m4f-cg75-76w2

NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

MEDIUM 60

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00254 Published 2025-12-09 Fixed in 3.4.0 CWE-79

TI-2025-40896 CVE-2025-66469 · GHSA-72qc-wxch-74mg

NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection

MEDIUM 60

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00275 Published 2025-12-08 Fixed in 3.4.0 CWE-79

TI-2025-33319 CVE-2025-53354 · GHSA-8c95-hpq2-w46f

NiceGUI is vulnerable to Reflected XSS attack

MEDIUM 60

NiceGUI is a Python-based UI framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00204 Published 2025-10-03 Fixed in 3.0.0 CWE-79

TI-2025-15578 CVE-2025-21618 · GHSA-v6jv-p6r8-j78w

NiceGUI On Air authentication issue

HIGH 72

NiceGUI is an easy-to-use, Python-based UI framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00392 Published 2025-01-06 Fixed in 2.9.1 CWE-287

TI-2024-21104 CVE-2024-32005 · GHSA-mwc7-64wg-pgvj

Local File Inclusion in NiceGUI leaflet component

HIGH 75

NiceGUI is an easy-to-use, Python-based UI framework.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.0076 Published 2024-04-12 Fixed in 1.4.21 CWE-22

Vulnerabilities

Filters