nicegui has 16 CVEs on record between 2024 and 2026. The busiest recent month was January 2026 with 4. The median CVSS is 6.1 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.1
- Publish → KEV
- —
- Last 90 days
- 0 prev 3
Products
- nicegui 16
Worst active — by depth score
CVE-2025-66470Medium· 6.1NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content46CVE-2024-32005High· 8.2NiceGUI allows potential access to local file system45CVE-2026-45553High· 7.5NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()41CVE-2025-66645High· 7.5NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read41CVE-2025-21618High· 7.5NiceGUI On Air authentication issue41
nicegui vulnerabilities
CVEs affecting nicegui, newest first. Open any entry for full detail, references, and exploit status.
16 CVEsRSS
CVE-2026-45554Medium· 5.3NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes
NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes
CVE-2026-45553High· 7.5NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
CVE-2026-39844Medium· 5.9NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
CVE-2026-33332Medium· 5.3NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
CVE-2026-27156Medium· 6.1NiceGUI vulnerable to XSS via Code Injection during client-side element function execution
NiceGUI vulnerable to XSS via Code Injection during client-side element function execution
CVE-2026-25516Medium· 6.1NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
CVE-2026-21874Medium· 5.3NiceGUI has Redis connection leak via tab storage causes service degradation
NiceGUI has Redis connection leak via tab storage causes service degradation
CVE-2026-21873High· 7.2NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
CVE-2026-21872Medium· 6.1NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
CVE-2026-21871Medium· 6.1NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
CVE-2025-66645High· 7.5NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read
NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read
CVE-2025-66469Medium· 6.1NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
CVE-2025-66470Medium· 6.1PoCNiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
CVE-2025-53354Medium· 6.1NiceGUI has a Reflected XSS
NiceGUI has a Reflected XSS
CVE-2025-21618High· 7.5NiceGUI On Air authentication issue
NiceGUI On Air authentication issue
CVE-2024-32005High· 8.2NiceGUI allows potential access to local file system
NiceGUI allows potential access to local file system