synth-mapping-helper (>=1.5.13, <=1.5.14) potentially affected by CVE-2026-33332 via nicegui (2.18.0)

nicegui PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.13, =1.5.14 Source cves: CVE-2026-33332 Source advisory: OSV:PYSEC-2026-2233...

synth-mapping-helper (1.5.15) potentially affected by CVE-2026-33332 via nicegui (2.19.0)

nicegui PYPI version 2.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.5.15 Source cves: CVE-2026-33332 Source advisory: OSV:PYSEC-2026-2233...

mcp-open-client (0.4.27), synth-mapping-helper (>=1.5.16, <=1.5.18) potentially affected by CVE-2026-33332 via nicegui (2.21.1)

nicegui PYPI version 2.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - mcp-open-client 0.4.27 - synth-mapping-helper =1.5.16, =1.5.18 Source cves: CVE-2026-33332 Source advisory: OSV:PYSEC-2026-2233...

haywire-core (0.0.2), openorchestrator (>=2.0.0rc1, <=3.0.0) +1 more potentially affected by CVE-2026-33332 via nicegui (2.22.2)

nicegui PYPI version 2.22.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - haywire-core 0.0.2 - openorchestrator =2.0.0rc1, =3.0.0 - space-stream 0.1.3 Source cves: CVE-2026-33332 Source advisory: OSV:PYSEC-2026-2233...

otanalytics (>=0.6.15, <=0.7.5), synth-mapping-helper (1.5.19) potentially affected by CVE-2026-33332 via nicegui (2.24.1)

nicegui PYPI version 2.24.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - otanalytics =0.6.15, =0.7.5 - synth-mapping-helper 1.5.19 Source cves: CVE-2026-33332 Source advisory: OSV:PYSEC-2026-2233...

ai-plays-jackbox (>=0.0.1, <=0.3.2), air-link (>=0.3.0, <=0.5.0) +23 more potentially affected by CVE-2026-33332 via nicegui (2.24.2)

nicegui PYPI version 2.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - ai-plays-jackbox =0.0.1, =0.3.0, =0.8.0, =1.11.0b1, =0.13.24, =0.2.14, =0.30.0, =2.0.0, =0.2.0, =0.2.0, =0.0.1, =0.0.4 and more Source cves:...

aignostics (>=0.2.200, <=0.2.226), auth-web-kit (>=0.1.0, <=1.2.1) +10 more potentially affected by CVE-2026-33332 via nicegui (>=3.0.0rc1, <=3.8.0)

nicegui PYPI version =3.0.0rc1, =0.2.200, =0.1.0, =0.1.3, =0.9.0, =0.12.0, =0.1.10.31, =0.3.1, =0.4.24, =0.4.25 - nicegui-legacy-browser 0.1.1 - relationalai 0.13.6 - synth-mapping-helper 1.5.20 Source cves: CVE-2026-33332 Source advisory: OSV:PYSEC-2026-2233...

CVE-2026-33332

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...

CVE-2026-33332 NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...

CVE-2026-33332

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...

CVE-2026-33332 NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...

CVE-2026-33332 NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...

CVE-2026-33332

CVE-2026-33332 affects NiceGUI prior to v3.9.0. The media routes app.add_media_file() and app.add_media_files() accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing a...

EUVD-2026-14179

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...

CVE-2026-33332

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +55 more potentially affected by CVE-2026-33332 via nicegui (>=0.5.9, <=3.8.0)

nicegui PYPI version =0.5.9, =0.0.1, =0.2.200, =0.0.0, =0.1.0, =0.1.3, =0.1.0, =1.1.3, =0.6.7, =1.0.0, =1.2.0, =1.23.0 and more Source cves: CVE-2026-33332 Source advisory: MEND:CVE-2026-33332...

NiceGUI security vulnerability

NiceGUI is an easy-to-use, Python-based UI framework developed under the NiceGUI open source project. Versions of NiceGUI prior to 3.9.0 contained security vulnerabilities. These vulnerabilities stemmed from the media routing functions in app.addmediafile and app.addmediafiles, which allowed...

CVE-2026-33332: Improper Input Validation

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...

Improper Validation of Specified Quantity in Input

Overview nicegui is a Create web-based user interfaces with Python. The nice way. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the chunksize parameter in app.addmediafile and app.addmediafiles media routes. An attacker can cause excessi...

NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

Summary NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and...