aignostics (>=0.2.200, <=0.2.226), auth-web-kit (>=0.1.0, <=1.2.1) +13 more potentially affected by CVE-2026-45553 via nicegui (>=3.0.0rc1, <=3.10.0)

nicegui PYPI version =3.0.0rc1, =0.2.200, =0.1.0, =0.1.3, =0.9.0, =0.12.0, =1.0.126, =0.1.10.31, =0.3.1, =0.4.24, =1.0.0, =1.5.20, =12.22.3, =12.22.5 Source cves: CVE-2026-45553 Source advisory: OSV:GHSA-JFRM-RX66-G536...

aignostics (>=0.2.200, <=0.2.226), auth-web-kit (>=0.1.0, <=1.2.1) +13 more potentially affected by CVE-2026-45553 via nicegui (>=3.0.0rc1, <=3.10.0)

nicegui PYPI version =3.0.0rc1, =0.2.200, =0.1.0, =0.1.3, =0.9.0, =0.12.0, =1.0.126, =0.1.10.31, =0.3.1, =0.4.24, =1.0.0, =1.5.20, =12.22.3, =12.22.5 Source cves: CVE-2026-45553 Source advisory: SNYK:PYTHON-NICEGUI-16757863...

PT-2026-41779

Name of the Vulnerable Software and Affected Versions NiceGUI versions prior to 3.12.0 Description Two FastAPI routes used for serving per-component static assets accept a sub-path parameter that can resolve to a directory instead of a file. When a request resolves to a directory, it triggers an...

Malicious Package

Overview nicegui is a malicious package. This package contains malicious code designed to steal sensitive credentials and establish remote access. While these packages might attempt to impersonate legitimate organizations and popular open-source libraries, there is no connection between those...

PT-2026-41235

Name of the Vulnerable Software and Affected Versions NiceGUI affected versions not specified Description The ui.restructured text function renders reStructuredText server-side using Docutils without disabling file insertion directives. When attacker-controlled content is passed to this function,...

📄 NiceGUI 3.6.1 Path Traversal

NiceGUI version 3.6.1 suffers from a path traversal vulnerability. Exploit Title: NiceGUI 3.6.1 - Path Traversal Author: Mohammed Idrees Banyamer Instagram: @banyamersecurity GitHub: https://github.com/mbanyamer Date: 2025-06-06 Tested on: NiceGUI = 3.6.1 Python 3.8–3.12 on Linux/Windows CVE:...

NiceGUI 3.6.1 - Path Traversal

Exploit Title: NiceGUI 3.6.1 - Path Traversal Author: Mohammed Idrees Banyamer Instagram: @banyamersecurity GitHub: https://github.com/mbanyamer Date: 2025-06-06 Tested on: NiceGUI = 3.6.1 Python 3.8–3.12 on Linux/Windows CVE: CVE-2026-25732 Affected Versions: = 3.6.1 fixed in 3.7.0 Type: Remote...

Malicious code in nicegui (npm)

Malicious npm package published by threat actor "ryanmccollum1" typosquatting the popular Python NiceGUI framework. Part of the same supply chain attack campaign as redeem-onchain-sdk, which collects SSH keys, AWS credentials, .npmrc tokens, Docker auth, Chrome saved logins, .env files, and git...

MAL-2026-3180 Malicious code in nicegui (npm)

Malicious npm package published by threat actor "ryanmccollum1" typosquatting the popular Python NiceGUI framework. Part of the same supply chain attack campaign as redeem-onchain-sdk, which collects SSH keys, AWS credentials, .npmrc tokens, Docker auth, Chrome saved logins, .env files, and git...

PYSEC-2026-2234

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes / as path separators, an attacker can bypass this sanitization on Windows by using backslashes \ in the upload filename. Applications that construct file paths using file.name a pattern...

rosys (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-39844 via nicegui (0.5.9)

nicegui PYPI version 0.5.9 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.3.0, =0.3.1 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

rosys (0.3.2) potentially affected by CVE-2026-39844 via nicegui (0.6.1)

nicegui PYPI version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.3.2 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

rosys (>=0.3.3, <=0.4.5) potentially affected by CVE-2026-39844 via nicegui (0.6.5)

nicegui PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.3.3, =0.4.5 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

rosys (0.4.9) potentially affected by CVE-2026-39844 via nicegui (0.6.9)

nicegui PYPI version 0.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.4.9 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

rosys (>=0.4.10, <=0.4.12) potentially affected by CVE-2026-39844 via nicegui (0.6.10)

nicegui PYPI version 0.6.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.4.10, =0.4.12 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

rosys (>=0.4.13, <=0.5.0) potentially affected by CVE-2026-39844 via nicegui (0.6.12)

nicegui PYPI version 0.6.12 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.4.13, =0.5.0 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

rosys (>=0.5.1, <=0.5.2) potentially affected by CVE-2026-39844 via nicegui (0.7.2)

nicegui PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.1, =0.5.2 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

rosys (>=0.5.3, <=0.5.10) potentially affected by CVE-2026-39844 via nicegui (0.7.6)

nicegui PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.3, =0.5.10 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

rosys (>=0.5.11, <=0.5.12) potentially affected by CVE-2026-39844 via nicegui (0.7.10)

nicegui PYPI version 0.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.11, =0.5.12 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

rosys (0.5.13) potentially affected by CVE-2026-39844 via nicegui (0.7.15)

nicegui PYPI version 0.7.15 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.5.13 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...