synth-mapping-helper (>=1.5.3, <=1.5.7) potentially affected by CVE-2026-39844 via nicegui (2.5.0)

nicegui PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.3, =1.5.7 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

synth-mapping-helper (1.5.8) potentially affected by CVE-2026-39844 via nicegui (2.7.0)

nicegui PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.5.8 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

synth-mapping-helper (1.5.9) potentially affected by CVE-2026-39844 via nicegui (2.8.1)

nicegui PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.5.9 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

otanalytics (>=0.5.4, <=0.6.14), synth-mapping-helper (1.5.10) potentially affected by CVE-2026-39844 via nicegui (2.11.0)

nicegui PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - otanalytics =0.5.4, =0.6.14 - synth-mapping-helper 1.5.10 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

flinventory-gui (>=0.10.0, <=0.11.1), synth-mapping-helper (1.5.11) +1 more potentially affected by CVE-2026-39844 via nicegui (2.12.1)

nicegui PYPI version 2.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - flinventory-gui =0.10.0, =0.2.0, =0.2.11 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

relationalai (>=0.11.4, <=0.13.5) potentially affected by CVE-2026-39844 via nicegui (2.16.1)

nicegui PYPI version 2.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - relationalai =0.11.4, =0.13.5 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

synth-mapping-helper (1.5.12) potentially affected by CVE-2026-39844 via nicegui (2.17.0)

nicegui PYPI version 2.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.5.12 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

synth-mapping-helper (>=1.5.13, <=1.5.14) potentially affected by CVE-2026-39844 via nicegui (2.18.0)

nicegui PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.13, =1.5.14 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

synth-mapping-helper (1.5.15) potentially affected by CVE-2026-39844 via nicegui (2.19.0)

nicegui PYPI version 2.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.5.15 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

mcp-open-client (0.4.27), synth-mapping-helper (>=1.5.16, <=1.5.18) potentially affected by CVE-2026-39844 via nicegui (2.21.1)

nicegui PYPI version 2.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - mcp-open-client 0.4.27 - synth-mapping-helper =1.5.16, =1.5.18 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

haywire-core (0.0.2), openorchestrator (>=2.0.0rc1, <=3.0.0) +1 more potentially affected by CVE-2026-39844 via nicegui (2.22.2)

nicegui PYPI version 2.22.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - haywire-core 0.0.2 - openorchestrator =2.0.0rc1, =3.0.0 - space-stream 0.1.3 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

otanalytics (>=0.6.15, <=0.7.5), synth-mapping-helper (1.5.19) potentially affected by CVE-2026-39844 via nicegui (2.24.1)

nicegui PYPI version 2.24.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - otanalytics =0.6.15, =0.7.5 - synth-mapping-helper 1.5.19 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

ai-plays-jackbox (>=0.0.1, <=0.3.2), air-link (>=0.3.0, <=0.5.0) +23 more potentially affected by CVE-2026-39844 via nicegui (2.24.2)

nicegui PYPI version 2.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - ai-plays-jackbox =0.0.1, =0.3.0, =0.8.0, =1.11.0b1, =0.13.24, =0.2.14, =0.30.0, =2.0.0, =0.2.0, =0.2.0, =0.0.1, =0.0.4 and more Source cves:...

aignostics (>=0.2.200, <=0.2.226), auth-web-kit (>=0.1.0, <=1.2.1) +10 more potentially affected by CVE-2026-39844 via nicegui (>=3.0.0rc1, <=3.8.0)

nicegui PYPI version =3.0.0rc1, =0.2.200, =0.1.0, =0.1.3, =0.9.0, =0.12.0, =0.1.10.31, =0.3.1, =0.4.24, =0.4.25 - nicegui-legacy-browser 0.1.1 - relationalai 0.13.6 - synth-mapping-helper 1.5.20 Source cves: CVE-2026-39844 Source advisory: GHSA-W8WV-VFPC-HW2W...

aignostics (>=0.2.200, <=0.2.226), auth-web-kit (>=0.1.0, <=1.2.1) +10 more potentially affected by CVE-2026-39844 via nicegui (>=3.0.0rc1, <=3.8.0)

nicegui PYPI version =3.0.0rc1, =0.2.200, =0.1.0, =0.1.3, =0.9.0, =0.12.0, =0.1.10.31, =0.3.1, =0.4.24, =0.4.25 - nicegui-legacy-browser 0.1.1 - relationalai 0.13.6 - synth-mapping-helper 1.5.20 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

aignostics (>=0.2.200, <=0.2.226), auth-web-kit (>=0.1.0, <=1.2.1) +10 more potentially affected by CVE-2026-39844 via nicegui (>=3.0.0rc1, <=3.8.0)

nicegui PYPI version =3.0.0rc1, =0.2.200, =0.1.0, =0.1.3, =0.9.0, =0.12.0, =0.1.10.31, =0.3.1, =0.4.24, =0.4.25 - nicegui-legacy-browser 0.1.1 - relationalai 0.13.6 - synth-mapping-helper 1.5.20 Source cves: CVE-2026-39844 Source advisory: SNYK:PYTHON-NICEGUI-15954191...

NiceGUI path traversal vulnerability

NiceGUI is an easy-to-use, Python-based UI framework developed under the open source license. Versions of NiceGUI prior to 3.10.0 contained a path traversal vulnerability. This vulnerability stemmed from an inability to bypass path cleaning, which could lead to arbitrary file writing on Windows...

CVE-2026-39844: Improper Limitation of a Pathname to a Restricted Directory

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes / as path separators, an attacker can bypass this sanitization on Windows by using backslashes \ in the upload filename. Applications that construct file paths using file.name a pattern...

CVE-2026-33332

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...

PYSEC-2026-2233

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...