1397 matches found
rosys (>=0.3.3, <=0.4.5) potentially affected by CVE-2025-66469 via nicegui (0.6.5)
nicegui PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.3.3, =0.4.5 Source cves: CVE-2025-66469 Source advisory: OSV:GHSA-72QC-WXCH-74MG...
aignostics (>=0.2.200, <=0.2.226), bindmc (>=0.1.3, <=0.1.11) +3 more potentially affected by CVE-2025-66469 via nicegui (>=3.0.0rc1, <=3.3.1)
nicegui PYPI version =3.0.0rc1, =0.2.200, =0.1.3, =0.4.24, =0.4.25 Source cves: CVE-2025-66469 Source advisory: SNYK:PYTHON-NICEGUI-14222432...
Cross-site Scripting (XSS)
Overview nicegui is a Create web-based user interfaces with Python. The nice way. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ui.addcss, ui.addscss, and ui.addsass functions. An attacker can execute arbitrary JavaScript in the context of the user's browser...
nice-gui-utils (>=0.1.2.dev0, <=0.1.2.dev3) potentially affected by CVE-2025-66469 via nicegui (1.4.1)
nicegui PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - nice-gui-utils =0.1.2.dev0, =0.1.2.dev3 Source cves: CVE-2025-66469 Source advisory: OSV:GHSA-72QC-WXCH-74MG...
rosys (>=0.4.10, <=0.4.12) potentially affected by CVE-2025-66469 via nicegui (0.6.10)
nicegui PYPI version 0.6.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.4.10, =0.4.12 Source cves: CVE-2025-66469 Source advisory: OSV:GHSA-72QC-WXCH-74MG...
rosys (>=0.4.13, <=0.5.0) potentially affected by CVE-2025-66469 via nicegui (0.6.12)
nicegui PYPI version 0.6.12 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.4.13, =0.5.0 Source cves: CVE-2025-66469 Source advisory: OSV:GHSA-72QC-WXCH-74MG...
otanalytics (>=0.5.4, <=0.6.14), synth-mapping-helper (1.5.10) potentially affected by CVE-2025-66469 via nicegui (2.11.0)
nicegui PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - otanalytics =0.5.4, =0.6.14 - synth-mapping-helper 1.5.10 Source cves: CVE-2025-66469 Source advisory: OSV:GHSA-72QC-WXCH-74MG...
air-link (>=0.0.0, <=0.2.1), broh5 (1.3.2) +16 more potentially affected by CVE-2025-66469 via nicegui (1.4.37)
nicegui PYPI version 1.4.37 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - air-link =0.0.0, =0.1.0, =1.1.3, =0.6.7, =1.0.0, =1.14.5, =0.0.2a5, =1.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves:...
PT-2025-49682
Name of the Vulnerable Software and Affected Versions NiceGUI versions 3.3.1 and below Description NiceGUI, a Python-based UI framework, has an issue where the ui.interactive image component can be exploited for cross-site scripting XSS. The component renders Scalable Vector Graphics SVG content...
PT-2025-49681
Name of the Vulnerable Software and Affected Versions NiceGUI versions 3.3.1 and below Description NiceGUI, a Python-based UI framework, has an issue where the ui.add css, ui.add scss, and ui.add sass functions do not properly sanitize or encode JavaScript contexts. This allows an attacker to...
Cross-Site Scripting (XSS)
nicegui is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the framework not sanitizing HTML or JavaScript when rendering unescaped user input through ui.html, which allows an attacker to execute arbitrary JavaScript in a user’s browser...
CVE-2025-53354
NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting XSS when developers render unescaped user input into the DOM using ui.html. NiceGUI did not enforce HTML or JavaScript sanitization, so applications that directly combine components like ui.inpu...
CVE-2025-53354
NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting XSS when developers render unescaped user input into the DOM using ui.html. NiceGUI did not enforce HTML or JavaScript sanitization, so applications that directly combine components like ui.inpu...
EUVD-2025-0044
Malicious code in bioql PyPI...
EUVD-2024-1257
Malicious code in bioql PyPI...
CVE-2025-53354 NiceGUI is vulnerable to Reflected XSS attack
NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting XSS when developers render unescaped user input into the DOM using ui.html. NiceGUI did not enforce HTML or JavaScript sanitization, so applications that directly combine components like ui.inpu...
EUVD-2025-32318
NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting XSS when developers render unescaped user input into the DOM using ui.html. NiceGUI did not enforce HTML or JavaScript sanitization, so applications that directly combine components like ui.inpu...
CVE-2025-53354 NiceGUI is vulnerable to Reflected XSS attack
NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting XSS when developers render unescaped user input into the DOM using ui.html. NiceGUI did not enforce HTML or JavaScript sanitization, so applications that directly combine components like ui.inpu...
CVE-2025-53354
NiceGUI is affected by a Cross-Site Scripting (XSS) vulnerability when rendering unescaped user input into the DOM via ui.html() (and related HTML content in ui.chat_message). Versions 2.24.2 and below are vulnerable; the issue stems from not sanitizing HTML/JavaScript inputs. Applications that c...
CVE-2025-53354 NiceGUI is vulnerable to Reflected XSS attack
NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting XSS when developers render unescaped user input into the DOM using ui.html. NiceGUI did not enforce HTML or JavaScript sanitization, so applications that directly combine components like ui.inpu...