Skip to contentZauberzeug Nicegui vulnerabilities
- zauberzeug niceguiNiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routesCVE-2026-45554Fix available5.3 Medium
- zauberzeug niceguiNiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()CVE-2026-45553Fix available7.5 High
- zauberzeug niceguiNiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath SanitizationCVE-2026-39844Fix available5.9 Medium
- zauberzeug niceguiNiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustionCVE-2026-33332Fix available6.9 Medium
- zauberzeug niceguiNiceGUI has XSS via Code InjectionCVE-2026-27156Fix available6.1 Medium
- zauberzeug niceguiNiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File WriteCVE-2026-25732Public exploitFix available7.5 High
- zauberzeug niceguiNiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML contentCVE-2026-25516Fix available6.1 Medium
- zauberzeug niceguiNiceGUI has Redis connection leak via tab storage causes service degradationCVE-2026-21874Fix available5.3 Medium
- zauberzeug niceguiZero-click XSS in all NiceGUI apps which uses `ui.sub_pages`CVE-2026-21873Fix available7.2 High
- zauberzeug niceguiNiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided linksCVE-2026-21872Fix available6.1 Medium
- zauberzeug niceguiNiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()CVE-2026-21871Fix available6.1 Medium
- zauberzeug niceguiNiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File ReadingCVE-2025-66645Public exploitFix available7.5 High
- zauberzeug niceguiNiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG contentCVE-2025-66470Public exploitFix available6.1 Medium
- zauberzeug niceguiNiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style InjectionCVE-2025-66469Fix available6.1 Medium
- zauberzeug niceguiNiceGUI is vulnerable to Reflected XSS attackCVE-2025-53354Fix available6.1 Medium
- zauberzeug niceguiNiceGUI On Air authentication issueCVE-2025-21618Fix available7.5 High
- zauberzeug niceguiLocal File Inclusion in NiceGUI leaflet componentCVE-2024-32005Fix available8.2 High