synth-mapping-helper (>=1.5.13, <=1.5.14) potentially affected by CVE-2026-33332 via nicegui (2.18.0)

nicegui PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.13, =1.5.14 Source cves: CVE-2026-33332 Source advisory: OSV:GHSA-W5G8-5849-VJ76...

synth-mapping-helper (1.5.15) potentially affected by CVE-2026-33332 via nicegui (2.19.0)

nicegui PYPI version 2.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.5.15 Source cves: CVE-2026-33332 Source advisory: OSV:GHSA-W5G8-5849-VJ76...

mcp-open-client (0.4.27), synth-mapping-helper (>=1.5.16, <=1.5.18) potentially affected by CVE-2026-33332 via nicegui (2.21.1)

nicegui PYPI version 2.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - mcp-open-client 0.4.27 - synth-mapping-helper =1.5.16, =1.5.18 Source cves: CVE-2026-33332 Source advisory: OSV:GHSA-W5G8-5849-VJ76...

haywire-core (0.0.2), openorchestrator (>=2.0.0rc1, <=3.0.0) +1 more potentially affected by CVE-2026-33332 via nicegui (2.22.2)

nicegui PYPI version 2.22.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - haywire-core 0.0.2 - openorchestrator =2.0.0rc1, =3.0.0 - space-stream 0.1.3 Source cves: CVE-2026-33332 Source advisory: OSV:GHSA-W5G8-5849-VJ76...

otanalytics (>=0.6.15, <=0.7.5), synth-mapping-helper (1.5.19) potentially affected by CVE-2026-33332 via nicegui (2.24.1)

nicegui PYPI version 2.24.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - otanalytics =0.6.15, =0.7.5 - synth-mapping-helper 1.5.19 Source cves: CVE-2026-33332 Source advisory: OSV:GHSA-W5G8-5849-VJ76...

ai-plays-jackbox (>=0.0.1, <=0.3.2), air-link (>=0.3.0, <=0.5.0) +23 more potentially affected by CVE-2026-33332 via nicegui (2.24.2)

nicegui PYPI version 2.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - ai-plays-jackbox =0.0.1, =0.3.0, =0.8.0, =1.11.0b1, =0.13.24, =0.2.14, =0.30.0, =2.0.0, =0.2.0, =0.2.0, =0.0.1, =0.0.4 and more Source cves:...

aignostics (>=0.2.200, <=0.2.226), auth-web-kit (>=0.1.0, <=1.2.1) +10 more potentially affected by CVE-2026-33332 via nicegui (>=3.0.0rc1, <=3.8.0)

nicegui PYPI version =3.0.0rc1, =0.2.200, =0.1.0, =0.1.3, =0.9.0, =0.12.0, =0.1.10.31, =0.3.1, =0.4.24, =0.4.25 - nicegui-legacy-browser 0.1.1 - relationalai 0.13.6 - synth-mapping-helper 1.5.20 Source cves: CVE-2026-33332 Source advisory: GHSA-W5G8-5849-VJ76...

aignostics (>=0.2.200, <=0.2.226), auth-web-kit (>=0.1.0, <=1.2.1) +10 more potentially affected by CVE-2026-33332 via nicegui (>=3.0.0rc1, <=3.8.0)

nicegui PYPI version =3.0.0rc1, =0.2.200, =0.1.0, =0.1.3, =0.9.0, =0.12.0, =0.1.10.31, =0.3.1, =0.4.24, =0.4.25 - nicegui-legacy-browser 0.1.1 - relationalai 0.13.6 - synth-mapping-helper 1.5.20 Source cves: CVE-2026-33332 Source advisory: OSV:GHSA-W5G8-5849-VJ76...

aignostics (>=0.2.200, <=0.2.226), auth-web-kit (>=0.1.0, <=1.2.1) +10 more potentially affected by CVE-2026-33332 via nicegui (>=3.0.0rc1, <=3.8.0)

nicegui PYPI version =3.0.0rc1, =0.2.200, =0.1.0, =0.1.3, =0.9.0, =0.12.0, =0.1.10.31, =0.3.1, =0.4.24, =0.4.25 - nicegui-legacy-browser 0.1.1 - relationalai 0.13.6 - synth-mapping-helper 1.5.20 Source cves: CVE-2026-33332 Source advisory: SNYK:PYTHON-NICEGUI-15701842...

PT-2026-26484

Name of the Vulnerable Software and Affected Versions NiceGUI versions prior to 3.9.0 Description NiceGUI’s app.add media file and app.add media files functions are susceptible to a flaw where a user-controlled query parameter, passed to the range-response implementation without validation, can...

CVE-2026-27156

NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements Element.runmethod, AgGrid.rungridmethod, EChart.runchartmethod, and others use an eval fallback in the JavaScript-side runMethod function. When user-controlled input i...

rosys (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-27156 via nicegui (0.5.9)

nicegui PYPI version 0.5.9 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.3.0, =0.3.1 Source cves: CVE-2026-27156 Source advisory: OSV:GHSA-78QV-3MPX-9CQQ...

rosys (0.3.2) potentially affected by CVE-2026-27156 via nicegui (0.6.1)

nicegui PYPI version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.3.2 Source cves: CVE-2026-27156 Source advisory: OSV:GHSA-78QV-3MPX-9CQQ...

rosys (>=0.3.3, <=0.4.5) potentially affected by CVE-2026-27156 via nicegui (0.6.5)

nicegui PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.3.3, =0.4.5 Source cves: CVE-2026-27156 Source advisory: OSV:GHSA-78QV-3MPX-9CQQ...

rosys (0.4.9) potentially affected by CVE-2026-27156 via nicegui (0.6.9)

nicegui PYPI version 0.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.4.9 Source cves: CVE-2026-27156 Source advisory: OSV:GHSA-78QV-3MPX-9CQQ...

rosys (>=0.4.10, <=0.4.12) potentially affected by CVE-2026-27156 via nicegui (0.6.10)

nicegui PYPI version 0.6.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.4.10, =0.4.12 Source cves: CVE-2026-27156 Source advisory: OSV:GHSA-78QV-3MPX-9CQQ...

rosys (>=0.4.13, <=0.5.0) potentially affected by CVE-2026-27156 via nicegui (0.6.12)

nicegui PYPI version 0.6.12 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.4.13, =0.5.0 Source cves: CVE-2026-27156 Source advisory: OSV:GHSA-78QV-3MPX-9CQQ...

rosys (>=0.5.1, <=0.5.2) potentially affected by CVE-2026-27156 via nicegui (0.7.2)

nicegui PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.1, =0.5.2 Source cves: CVE-2026-27156 Source advisory: OSV:GHSA-78QV-3MPX-9CQQ...

rosys (>=0.5.3, <=0.5.10) potentially affected by CVE-2026-27156 via nicegui (0.7.6)

nicegui PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.3, =0.5.10 Source cves: CVE-2026-27156 Source advisory: OSV:GHSA-78QV-3MPX-9CQQ...

rosys (>=0.5.11, <=0.5.12) potentially affected by CVE-2026-27156 via nicegui (0.7.10)

nicegui PYPI version 0.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.11, =0.5.12 Source cves: CVE-2026-27156 Source advisory: OSV:GHSA-78QV-3MPX-9CQQ...