synth-mapping-helper (>=1.4.8, <=1.5.0) potentially affected by CVE-2026-39844 via nicegui (1.4.36)

nicegui PYPI version 1.4.36 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.4.8, =1.5.0 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

air-link (>=0.0.0, <=0.2.1), broh5 (1.3.2) +16 more potentially affected by CVE-2026-39844 via nicegui (1.4.37)

nicegui PYPI version 1.4.37 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - air-link =0.0.0, =0.1.0, =1.1.3, =0.6.7, =1.0.0, =1.14.5, =0.0.2a5, =1.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves:...

synth-mapping-helper (>=1.5.1, <=1.5.2) potentially affected by CVE-2026-39844 via nicegui (2.3.0)

nicegui PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.1, =1.5.2 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

synth-mapping-helper (>=1.5.3, <=1.5.7) potentially affected by CVE-2026-39844 via nicegui (2.5.0)

nicegui PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.3, =1.5.7 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

synth-mapping-helper (1.5.8) potentially affected by CVE-2026-39844 via nicegui (2.7.0)

nicegui PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.5.8 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

synth-mapping-helper (1.5.9) potentially affected by CVE-2026-39844 via nicegui (2.8.1)

nicegui PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.5.9 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

otanalytics (>=0.5.4, <=0.6.14), synth-mapping-helper (1.5.10) potentially affected by CVE-2026-39844 via nicegui (2.11.0)

nicegui PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - otanalytics =0.5.4, =0.6.14 - synth-mapping-helper 1.5.10 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

flinventory-gui (>=0.10.0, <=0.11.1), synth-mapping-helper (1.5.11) +1 more potentially affected by CVE-2026-39844 via nicegui (2.12.1)

nicegui PYPI version 2.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - flinventory-gui =0.10.0, =0.2.0, =0.2.11 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

relationalai (>=0.11.4, <=0.13.5) potentially affected by CVE-2026-39844 via nicegui (2.16.1)

nicegui PYPI version 2.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - relationalai =0.11.4, =0.13.5 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

synth-mapping-helper (1.5.12) potentially affected by CVE-2026-39844 via nicegui (2.17.0)

nicegui PYPI version 2.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.5.12 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

synth-mapping-helper (>=1.5.13, <=1.5.14) potentially affected by CVE-2026-39844 via nicegui (2.18.0)

nicegui PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.13, =1.5.14 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

synth-mapping-helper (1.5.15) potentially affected by CVE-2026-39844 via nicegui (2.19.0)

nicegui PYPI version 2.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.5.15 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

mcp-open-client (0.4.27), synth-mapping-helper (>=1.5.16, <=1.5.18) potentially affected by CVE-2026-39844 via nicegui (2.21.1)

nicegui PYPI version 2.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - mcp-open-client 0.4.27 - synth-mapping-helper =1.5.16, =1.5.18 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

haywire-core (0.0.2), openorchestrator (>=2.0.0rc1, <=3.0.0) +1 more potentially affected by CVE-2026-39844 via nicegui (2.22.2)

nicegui PYPI version 2.22.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - haywire-core 0.0.2 - openorchestrator =2.0.0rc1, =3.0.0 - space-stream 0.1.3 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

otanalytics (>=0.6.15, <=0.7.5), synth-mapping-helper (1.5.19) potentially affected by CVE-2026-39844 via nicegui (2.24.1)

nicegui PYPI version 2.24.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - otanalytics =0.6.15, =0.7.5 - synth-mapping-helper 1.5.19 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

ai-plays-jackbox (>=0.0.1, <=0.3.2), air-link (>=0.3.0, <=0.5.0) +23 more potentially affected by CVE-2026-39844 via nicegui (2.24.2)

nicegui PYPI version 2.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - ai-plays-jackbox =0.0.1, =0.3.0, =0.8.0, =1.11.0b1, =0.13.24, =0.2.14, =0.30.0, =2.0.0, =0.2.0, =0.2.0, =0.0.1, =0.0.4 and more Source cves:...

aignostics (>=0.2.200, <=0.2.226), auth-web-kit (>=0.1.0, <=1.2.1) +10 more potentially affected by CVE-2026-39844 via nicegui (>=3.0.0rc1, <=3.8.0)

nicegui PYPI version =3.0.0rc1, =0.2.200, =0.1.0, =0.1.3, =0.9.0, =0.12.0, =0.1.10.31, =0.3.1, =0.4.24, =0.4.25 - nicegui-legacy-browser 0.1.1 - relationalai 0.13.6 - synth-mapping-helper 1.5.20 Source cves: CVE-2026-39844 Source advisory: OSV:PYSEC-2026-2234...

CVE-2026-39844

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes / as path separators, an attacker can bypass this sanitization on Windows by using backslashes \ in the upload filename. Applications that construct file paths using file.name a pattern...

CVE-2026-39844

CVE-2026-39844 affects NiceGUI prior to 3.10.0, where upload file names are sanitized using PurePosixPath(filename).name. On Windows, backslashes are not treated as path separators by PurePosixPath, allowing attackers to bypass sanitization with backslash-filled filenames. If applications constru...

CVE-2026-39844 NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes / as path separators, an attacker can bypass this sanitization on Windows by using backslashes \ in the upload filename. Applications that construct file paths using file.name a pattern...