nicegui vulnerabilities

CVEs whose affected-version data names the nicegui package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

nicegui vulnerabilities

NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes

NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()

NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows

NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

NiceGUI vulnerable to XSS via Code Injection during client-side element function execution

NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content

NiceGUI has Redis connection leak via tab storage causes service degradation

NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS

NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read

NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection

NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

NiceGUI has a Reflected XSS

NiceGUI On Air authentication issue

NiceGUI allows potential access to local file system