254 matches found
CVE-2026-33332 NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...
EUVD-2026-14179
NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...
CVE-2026-33332
CVE-2026-33332 affects NiceGUI prior to v3.9.0. The media routes app.add_media_file() and app.add_media_files() accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing a...
CVE-2026-33332 NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...
CVE-2026-33332
NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...
CVE-2026-33332 NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...
NiceGUI 安全漏洞
NiceGUI is an easy-to-use, Python-based UI framework developed under the NiceGUI open source project. Versions of NiceGUI prior to 3.9.0 contained security vulnerabilities. These vulnerabilities stemmed from the media routing functions in app.addmediafile and app.addmediafiles, which allowed...
GHSA-W5G8-5849-VJ76 NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
Summary NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and...
NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
Summary NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and...
acherion (>=0.2.0 <=0.9.2), aesp (=2025.9.12) +258 more potentially affected by CVE-2026-33332 via nicegui (>=0.9.11 <=3.8.0)
nicegui PYPI version =0.9.11, =0.2.0, =1.0.0, =0.0.1, =0.1.0, =0.2.0, =0.3.0, =0.0.0, =0.0.0, =0.4.14, =1.0.0, =0.1.0, =1.2.2 and more Source cves: CVE-2026-33332 Source advisory: OSV:GHSA-W5G8-5849-VJ76...
acherion (>=0.2.0 <=0.9.2), aesp (=2025.9.12) +207 more potentially affected by CVE-2026-33332 via nicegui (>=3.0.4 <=3.8.0)
nicegui PYPI version =3.0.4, =0.2.0, =1.0.0, =0.4.0, =0.1.0, =0.2.0, =0.3.0, =0.0.0, =0.4.14, =1.0.0, =0.1.0, =1.2.2 - bellatrex =0.4.0 and more Source cves: CVE-2026-33332 Source advisory: SNYK:PYTHON-NICEGUI-15701842...
Improper Validation of Specified Quantity in Input
Overview nicegui is a Create web-based user interfaces with Python. The nice way. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the chunksize parameter in app.addmediafile and app.addmediafiles media routes. An attacker can cause excessi...
PT-2026-26484
Name of the Vulnerable Software and Affected Versions NiceGUI versions prior to 3.9.0 Description NiceGUI’s app.add media file and app.add media files functions are susceptible to a flaw where a user-controlled query parameter, passed to the range-response implementation without validation, can...
CVE-2026-27156
NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements Element.runmethod, AgGrid.rungridmethod, EChart.runchartmethod, and others use an eval fallback in the JavaScript-side runMethod function. When user-controlled input i...
acherion (>=0.2.0 <=0.9.2), aesp (=2025.9.12) +207 more potentially affected by CVE-2026-27156 via nicegui (>=3.0.4 <=3.7.1)
nicegui PYPI version =3.0.4, =0.2.0, =1.0.0, =0.4.0, =0.1.0, =0.2.0, =0.3.0, =0.0.0, =0.4.14, =1.0.0, =1.1.3 - autestoy =0.1.0 - auth-web-kit =1.2.2 - bellatrex =0.4.0 and more Source cves: CVE-2026-27156 Source advisory: SNYK:PYTHON-NICEGUI-15346850...
GHSA-78QV-3MPX-9CQQ NiceGUI vulnerable to XSS via Code Injection during client-side element function execution
Summary Several NiceGUI APIs that execute methods on client-side elements Element.runmethod, AgGrid.rungridmethod, EChart.runchartmethod, and others use an eval fallback in the JavaScript-side runMethod function. When user-controlled input is passed as the method name, an attacker can inject...
acherion (>=0.2.0 <=0.9.2), aesp (=2025.9.12) +258 more potentially affected by CVE-2026-27156 via nicegui (>=0.9.11 <=3.7.1)
nicegui PYPI version =0.9.11, =0.2.0, =1.0.0, =0.0.1, =0.1.0, =0.2.0, =0.3.0, =0.0.0, =0.0.0, =0.4.14, =1.0.0, =1.1.3 - autestoy =0.1.0 - auth-web-kit =1.2.2 and more Source cves: CVE-2026-27156 Source advisory: OSV:GHSA-78QV-3MPX-9CQQ...
NiceGUI vulnerable to XSS via Code Injection during client-side element function execution
Summary Several NiceGUI APIs that execute methods on client-side elements Element.runmethod, AgGrid.rungridmethod, EChart.runchartmethod, and others use an eval fallback in the JavaScript-side runMethod function. When user-controlled input is passed as the method name, an attacker can inject...
CVE-2026-27156
NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements Element.runmethod, AgGrid.rungridmethod, EChart.runchartmethod, and others use an eval fallback in the JavaScript-side runMethod function. When user-controlled input i...
PYSEC-2026-2232
NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements Element.runmethod, AgGrid.rungridmethod, EChart.runchartmethod, and others use an eval fallback in the JavaScript-side runMethod function. When user-controlled input i...