1397 matches found
openadapt (>=0.8.0, <=0.8.1) potentially affected by CVE-2025-66645 via nicegui (1.2.24)
nicegui PYPI version 1.2.24 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - openadapt =0.8.0, =0.8.1 Source cves: CVE-2025-66645 Source advisory: OSV:GHSA-HXP3-63HC-5366...
synth-mapping-helper (>=1.5.13, <=1.5.14) potentially affected by CVE-2025-66645 via nicegui (2.18.0)
nicegui PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.13, =1.5.14 Source cves: CVE-2025-66645 Source advisory: OSV:GHSA-HXP3-63HC-5366...
rosys (0.8.3) potentially affected by CVE-2025-66645 via nicegui (1.2.10)
nicegui PYPI version 1.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.8.3 Source cves: CVE-2025-66645 Source advisory: OSV:GHSA-HXP3-63HC-5366...
kayalab (>=0.7.30, <=0.11.9) potentially affected by CVE-2025-66645 via nicegui (1.4.24)
nicegui PYPI version 1.4.24 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - kayalab =0.7.30, =0.11.9 Source cves: CVE-2025-66645 Source advisory: OSV:GHSA-HXP3-63HC-5366...
relationalai (>=0.11.4, <=0.13.5) potentially affected by CVE-2025-66645 via nicegui (2.16.1)
nicegui PYPI version 2.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - relationalai =0.11.4, =0.13.5 Source cves: CVE-2025-66645 Source advisory: OSV:GHSA-HXP3-63HC-5366...
ai-plays-jackbox (>=0.0.1, <=0.3.2), air-link (>=0.3.0, <=0.5.0) +23 more potentially affected by CVE-2025-66645 via nicegui (2.24.2)
nicegui PYPI version 2.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - ai-plays-jackbox =0.0.1, =0.3.0, =0.8.0, =1.11.0b1, =0.13.24, =0.2.14, =0.30.0, =2.0.0, =0.2.0, =0.2.0, =0.0.1, =0.0.4 and more Source cves:...
CVE-2025-66470
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactiveimage component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or...
CVE-2025-66469
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.addcss, ui.addscss, and ui.addsass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended or...
CVE-2025-66470 NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactiveimage component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or...
CVE-2025-66470
CVE-2025-66470 affects NiceGUI <= 3.3.1 via the ui.interactive_image component, which renders SVG content with Vue v-html without sanitization. This can lead to stored/reflected XSS through the SVG tag when images are rendered or updated. The issue is fixed in NiceGUI 3.4.0; remediation is to...
CVE-2025-66470 NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactiveimage component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or...
CVE-2025-66470 NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactiveimage component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or...
ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +51 more potentially affected by CVE-2025-66470 via nicegui (>=0.5.9, <=3.3.1)
nicegui PYPI version =0.5.9, =0.0.1, =0.2.200, =0.0.0, =0.1.3, =0.1.0, =1.1.3, =0.6.7, =1.0.0, =1.2.0, =0.10.0, =0.11.1 and more Source cves: CVE-2025-66470 Source advisory: MEND:CVE-2025-66470...
NiceGUI path traversal vulnerability
NiceGUI is an easy-to-use, Python-based UI framework open-sourced by NiceGUI. A path traversal vulnerability exists in NiceGUI 3.3.1 and earlier versions, which stems from a flaw in the App.addmediafiles function that could lead to a directory traversal attack...
NiceGUI cross-site scripting vulnerability
NiceGUI is an easy-to-use, Python-based UI framework open-sourced by NiceGUI. A cross-site scripting vulnerability exists in NiceGUI 3.3.1 and earlier versions, which stems from insufficient cleanup and escaping of the ui.addcss, ui.addscss, and ui.addsass functions, and could lead to a reflectiv...
NiceGUI security vulnerability
NiceGUI is an easy-to-use, Python-based UI framework open-sourced by NiceGUI. A security vulnerability exists in NiceGUI 3.3.1 and earlier versions, which stems from the ui.activeimage component not cleaning up SVG content, and could lead to cross-site scripting attacks...
CVE-2025-66645: Improper Limitation of a Pathname to a Restricted Directory
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.addmediafiles function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version 3.4.0...
CVE-2025-66469: Improper Neutralization of Input During Web Page Generation
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.addcss, ui.addscss, and ui.addsass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended or ,...
CVE-2025-66470: Improper Neutralization of Input During Web Page Generation
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactiveimage component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or...
PT-2025-50275
Name of the Vulnerable Software and Affected Versions NiceGUI versions 3.3.1 and below Description NiceGUI, a Python-based UI framework, contains a flaw that allows a remote attacker to read arbitrary files on the server filesystem. This is due to a directory traversal issue present in the App.ad...