CVE-2025-66470

NiceGUI XSS Scanner - CVE-2025-66470 📸 Screenshot A fast, simple scanner for detecting CVE-2025-66470 - XSS vulnerability in NiceGUI's ui.interactiveimage component. 🔍 Vulnerability Details Field| Value ---|--- CVE| CVE-2025-66470 GHSA| GHSA-2m4f-cg75-76w2 Component| ui.interactiveimage Affected|...

CVE-2026-25732-NiceGUI-3.6.1

Author: Mohammed Idrees Banyamer Contact: Instagram: @banyamersecurity GitHub: https://github.com/mbanyamer CVE-2026-25732 — NiceGUI Path Traversal in FileUpload → Arbitrary File Write Exploit Title: NiceGUI Path Traversal in FileUpload Leading to Arbitrary File Write Date: 2025-06-06 Tested on:...

Malware in nicegui

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Exploit for Path Traversal in Zauberzeug Nicegui

CVE-2025-66645 — NiceGUI Path Traversal CTF 교육용으로 허가된 로컬/격리 환...

NiceGUI 3.3.1 Path Traversal

NiceGUI version 3.3.1 contains a path traversal vulnerability in App.addmediafiles that allows unauthenticated remote attackers to read arbitrary files. Included proof of concept demonstrates retrieval of a protected lab flag. https://packetstorm.news/download/235842...

NiceGUI Detection

An instance running NiceGUI is detected by looking for specific HTTP headers. !/usr/bin/env python3 -- coding: utf-8 -- """An instance running NiceGUI is detected by looking for specific HTTP headers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

PYSEC-2026-2680 NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes

Summary Two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log...

NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes

SummaryTwo FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log ...

NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()

Summaryui.restructuredtext renders reStructuredText server-side with Docutils without disabling file insertion directives.When a NiceGUI application passes attacker-controlled content to ui.restructuredtext, an attacker can use standard Docutils directives include, csv-table with :file:, raw with...

PYSEC-2026-2679 NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()

Summary ui.restructuredtext renders reStructuredText server-side with Docutils without disabling file insertion directives. When a NiceGUI application passes attacker-controlled content to ui.restructuredtext, an attacker can use standard Docutils directives include, csv-table with :file:, raw wi...

PYSEC-2026-1703 NiceGUI has Redis connection leak via tab storage causes service degradation

Summary An unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connections are never released, leading to service degradation when Redis hits its connection limit. NiceGUI continues accepting...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +34 more potentially affected by CVE-2026-21874 via nicegui (>=2.11.0, <=3.3.1)

nicegui PYPI version =2.11.0, =0.0.1, =0.2.200, =0.3.0, =0.1.3, =0.8.0, =0.10.0, =1.11.0b1, =0.13.24, =0.4.24, =0.2.14, =0.2.24 and more Source cves: CVE-2026-21874 Source advisory: OSV:PYSEC-2026-1703...

PYSEC-2026-1701 NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

Summary An unsafe implementation in the click event listener used by ui.subpages, combined with attacker-controlled link rendering on the page, causes an XSS when the user actively clicks on the link. Details 1. On click, eventually subpagesnavigate event is emitted...

PYSEC-2026-1698 NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

Summary XSS risk exists in NiceGUI when developers pass attacker-controlled strings into ui.navigate.history.push or ui.navigate.history.replace. These helpers are documented as History API wrappers for updating the browser URL without page reload. However, if the URL argument is embedded into...

NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

SummaryXSS risk exists in NiceGUI when developers pass attacker-controlled strings into ui.navigate.history.push or ui.navigate.history.replace. These helpers are documented as History API wrappers for updating the browser URL without page reload. However, if the URL argument is embedded into...

NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

SummaryAn unsafe implementation in the click event listener used by ui.subpages, combined with attacker-controlled link rendering on the page, causes an XSS when the user actively clicks on the link. Details1. On click, eventually subpagesnavigate event is...

PYSEC-2026-1702 NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS

Summary An unsafe implementation in the pushstate event listener used by ui.subpages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site, using an iframe. Details The problem is traced as follows: 1. On pushstate, handleStateEvent is...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +31 more potentially affected by CVE-2026-21872 via nicegui (>=2.22.2, <=3.3.1)

nicegui PYPI version =2.22.2, =0.0.1, =0.2.200, =0.3.0, =0.1.3, =0.8.0, =1.11.0b1, =0.13.24, =0.4.24, =0.2.14, =0.30.0, =0.30.8 and more Source cves: CVE-2026-21872 Source advisory: OSV:PYSEC-2026-1701...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +31 more potentially affected by CVE-2026-21873 via nicegui (>=2.22.2, <=3.3.1)

nicegui PYPI version =2.22.2, =0.0.1, =0.2.200, =0.3.0, =0.1.3, =0.8.0, =1.11.0b1, =0.13.24, =0.4.24, =0.2.14, =0.30.0, =0.30.8 and more Source cves: CVE-2026-21873 Source advisory: OSV:PYSEC-2026-1702...

NiceGUI has Redis connection leak via tab storage causes service degradation

SummaryAn unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connections are never released, leading to service degradation when Redis hits its connection limit.NiceGUI continues accepting ne...