MEDIUM6.1PyPI
GHSA-2m4f-cg75-76w2· CVE-2025-66470, PYSEC-2026-1696NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
Modified: 7/7/2026
package
PyPI/nicegui
pkg:pypi/nicegui
MEDIUM6.1PyPI
GHSA-72qc-wxch-74mg· CVE-2025-66469, PYSEC-2026-1697NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
Modified: 7/7/2026
MEDIUM6.1PyPI
GHSA-78qv-3mpx-9cqq· CVE-2026-27156, PYSEC-2026-2232NiceGUI vulnerable to XSS via Code Injection during client-side element function execution
Modified: 7/13/2026
MEDIUM6.1PyPI
GHSA-7grm-h62g-5m97· CVE-2026-21871, PYSEC-2026-1698NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
Modified: 7/7/2026
MEDIUM6.1PyPI
GHSA-8c95-hpq2-w46f· CVE-2025-53354, PYSEC-2026-1699NiceGUI has a Reflected XSS
Modified: 7/7/2026
HIGH7.5PyPI
GHSA-9ffm-fxg3-xrhh· CVE-2026-25732, PYSEC-2026-95NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
Modified: 6/6/2026
HIGH7.5PyPI
GHSA-hxp3-63hc-5366· CVE-2025-66645, PYSEC-2026-1700NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read
Modified: 7/7/2026
HIGH7.5PyPI
GHSA-jfrm-rx66-g536· CVE-2026-45553, PYSEC-2026-2679NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
Modified: 7/13/2026
MEDIUM6.1PyPI
GHSA-m7j5-rq9j-6jj9· CVE-2026-21872, PYSEC-2026-1701NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
Modified: 7/7/2026
HIGH7.2PyPI
GHSA-mhpg-c27v-6mxr· CVE-2026-21873, PYSEC-2026-1702NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
Modified: 7/7/2026
MEDIUM5.3PyPI
GHSA-mp55-g7pj-rvm2· CVE-2026-21874, PYSEC-2026-1703NiceGUI has Redis connection leak via tab storage causes service degradation
Modified: 7/7/2026
HIGH8.2PyPI
GHSA-mwc7-64wg-pgvj· CVE-2024-32005, PYSEC-2026-1704NiceGUI allows potential access to local file system
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-pq7c-x8g4-rvp6· CVE-2026-45554, PYSEC-2026-2680NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes
Modified: 7/13/2026
HIGH7.5PyPI
GHSA-v6jv-p6r8-j78w· CVE-2025-21618, PYSEC-2026-1705NiceGUI On Air authentication issue
Modified: 7/7/2026
MEDIUM6.1PyPI
GHSA-v82v-c5x8-w282· CVE-2026-25516, PYSEC-2026-2231NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
Modified: 7/13/2026
MEDIUM5.3PyPI
GHSA-w5g8-5849-vj76· CVE-2026-33332, PYSEC-2026-2233NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
Modified: 7/13/2026
MEDIUM5.9PyPI
GHSA-w8wv-vfpc-hw2w· CVE-2026-39844, PYSEC-2026-2234NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
Modified: 7/13/2026
MEDIUM6.1PyPI
PYSEC-2026-1696· CVE-2025-66470, GHSA-2m4f-cg75-76w2NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
Modified: 7/7/2026
MEDIUM6.1PyPI
PYSEC-2026-1697· CVE-2025-66469, GHSA-72qc-wxch-74mgNiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
Modified: 7/7/2026
MEDIUM6.1PyPI
PYSEC-2026-1698· CVE-2026-21871, GHSA-7grm-h62g-5m97NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
Modified: 7/7/2026
MEDIUM6.1PyPI
PYSEC-2026-1699· CVE-2025-53354, GHSA-8c95-hpq2-w46fNiceGUI has a Reflected XSS
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1700· CVE-2025-66645, GHSA-hxp3-63hc-5366NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read
Modified: 7/7/2026
MEDIUM6.1PyPI
PYSEC-2026-1701· CVE-2026-21872, GHSA-m7j5-rq9j-6jj9NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
Modified: 7/7/2026
HIGH7.2PyPI
PYSEC-2026-1702· CVE-2026-21873, GHSA-mhpg-c27v-6mxrNiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-1703· CVE-2026-21874, GHSA-mp55-g7pj-rvm2NiceGUI has Redis connection leak via tab storage causes service degradation
Modified: 7/7/2026
HIGH8.2PyPI
PYSEC-2026-1704· CVE-2024-32005, GHSA-mwc7-64wg-pgvjNiceGUI allows potential access to local file system
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1705· CVE-2025-21618, GHSA-v6jv-p6r8-j78wNiceGUI On Air authentication issue
Modified: 7/7/2026
MEDIUM6.1PyPI
PYSEC-2026-2231· CVE-2026-25516, GHSA-v82v-c5x8-w282Modified: 7/13/2026
MEDIUM6.1PyPI
PYSEC-2026-2232· CVE-2026-27156, GHSA-78qv-3mpx-9cqqModified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2233· CVE-2026-33332, GHSA-w5g8-5849-vj76Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2234· CVE-2026-39844, GHSA-w8wv-vfpc-hw2wModified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2679· CVE-2026-45553, GHSA-jfrm-rx66-g536NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
Modified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-2680· CVE-2026-45554, GHSA-pq7c-x8g4-rvp6NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-95· CVE-2026-25732, GHSA-9ffm-fxg3-xrhhModified: 5/20/2026