nicegui has 14 CVEs on record between 2024 and 2026. The busiest recent month was January 2026 with 4. The median CVSS is 6.1 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.1
- Publish → KEV
- —
- Last 90 days
- 0 prev 2
Weakness classes
Products
- nicegui 14
Worst active — by depth score
CVE-2024-32005High· 8.2NiceGUI allows potential access to local file system45CVE-2026-45553High· 7.5NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()41CVE-2025-21618High· 7.5NiceGUI On Air authentication issue41CVE-2026-21873High· 7.2NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS40CVE-2026-27156Medium· 6.1NiceGUI vulnerable to XSS via Code Injection during client-side element function execution34
nicegui vulnerabilities
CVEs affecting nicegui, newest first. Open any entry for full detail, references, and exploit status.
14 CVEsRSS
CVE-2026-45554Medium· 5.3NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes
NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes
CVE-2026-45553High· 7.5NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
CVE-2026-39844Medium· 5.9NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
CVE-2026-33332Medium· 5.3NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
CVE-2026-27156Medium· 6.1NiceGUI vulnerable to XSS via Code Injection during client-side element function execution
NiceGUI vulnerable to XSS via Code Injection during client-side element function execution
CVE-2026-25516Medium· 6.1NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
CVE-2026-21874Medium· 5.3NiceGUI has Redis connection leak via tab storage causes service degradation
NiceGUI has Redis connection leak via tab storage causes service degradation
CVE-2026-21873High· 7.2NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
CVE-2026-21872Medium· 6.1NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
CVE-2026-21871Medium· 6.1NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
CVE-2025-66469Medium· 6.1NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
CVE-2025-53354Medium· 6.1NiceGUI is a Python-based UI framework
NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting (XSS) when developers render unescaped user input into the DOM using ui.html(). NiceGUI did not enforce HTML or JavaScript sanitizatio…
CVE-2025-21618High· 7.5NiceGUI On Air authentication issue
NiceGUI On Air authentication issue
CVE-2024-32005High· 8.2NiceGUI allows potential access to local file system
NiceGUI allows potential access to local file system