kayalab (>=0.1.0, <=0.7.29) potentially affected by CVE-2026-25732 via nicegui (1.4.13)

nicegui PYPI version 1.4.13 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - kayalab =0.1.0, =0.7.29 Source cves: CVE-2026-25732 Source advisory: OSV:PYSEC-2026-95...

kayalab (>=0.7.30, <=0.11.9) potentially affected by CVE-2026-25732 via nicegui (1.4.24)

nicegui PYPI version 1.4.24 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - kayalab =0.7.30, =0.11.9 Source cves: CVE-2026-25732 Source advisory: OSV:PYSEC-2026-95...

nice-gui-utils (>=0.1.2, <=0.1.5) potentially affected by CVE-2026-25732 via nicegui (1.4.2)

nicegui PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - nice-gui-utils =0.1.2, =0.1.5 Source cves: CVE-2026-25732 Source advisory: OSV:PYSEC-2026-95...

nice-gui-utils (0.1.6) potentially affected by CVE-2026-25732 via nicegui (1.4.3)

nicegui PYPI version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - nice-gui-utils 0.1.6 Source cves: CVE-2026-25732 Source advisory: OSV:PYSEC-2026-95...

forta-gate (0.1.0), openadapt (>=0.9.0, <=0.16.2) potentially affected by CVE-2026-25732 via nicegui (1.4.7)

nicegui PYPI version 1.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - forta-gate 0.1.0 - openadapt =0.9.0, =0.16.2 Source cves: CVE-2026-25732 Source advisory: OSV:PYSEC-2026-95...

openadapt (>=0.17.0, <=0.17.1) potentially affected by CVE-2026-25732 via nicegui (1.4.9)

nicegui PYPI version 1.4.9 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - openadapt =0.17.0, =0.17.1 Source cves: CVE-2026-25732 Source advisory: OSV:PYSEC-2026-95...

openorchestrator (>=1.1.0, <=1.3.1) potentially affected by CVE-2026-25732 via nicegui (1.4.12)

nicegui PYPI version 1.4.12 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - openorchestrator =1.1.0, =1.3.1 Source cves: CVE-2026-25732 Source advisory: OSV:PYSEC-2026-95...

synth-mapping-helper (1.4.7) potentially affected by CVE-2026-25732 via nicegui (1.4.30)

nicegui PYPI version 1.4.30 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.4.7 Source cves: CVE-2026-25732 Source advisory: OSV:PYSEC-2026-95...

air-link (>=0.0.0, <=0.2.1), broh5 (1.3.2) +16 more potentially affected by CVE-2026-25732 via nicegui (1.4.37)

nicegui PYPI version 1.4.37 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - air-link =0.0.0, =0.1.0, =1.1.3, =0.6.7, =1.0.0, =1.14.5, =0.0.2a5, =1.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves:...

finalynx (>=1.2.0, <=1.14.4) potentially affected by CVE-2026-25732 via nicegui (1.4.25)

nicegui PYPI version 1.4.25 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - finalynx =1.2.0, =1.14.4 Source cves: CVE-2026-25732 Source advisory: OSV:PYSEC-2026-95...

rosys (0.8.2) potentially affected by CVE-2026-25732 via nicegui (1.2.5)

nicegui PYPI version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.8.2 Source cves: CVE-2026-25732 Source advisory: OSV:PYSEC-2026-95...

synth-mapping-helper (>=1.4.8, <=1.5.0) potentially affected by CVE-2026-25732 via nicegui (1.4.36)

nicegui PYPI version 1.4.36 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.4.8, =1.5.0 Source cves: CVE-2026-25732 Source advisory: OSV:PYSEC-2026-95...

nice-gui-utils (>=0.1.2.dev0, <=0.1.2.dev3) potentially affected by CVE-2026-25732 via nicegui (1.4.1)

nicegui PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - nice-gui-utils =0.1.2.dev0, =0.1.2.dev3 Source cves: CVE-2026-25732 Source advisory: OSV:PYSEC-2026-95...

synth-mapping-helper (1.5.15) potentially affected by CVE-2026-25732 via nicegui (2.19.0)

nicegui PYPI version 2.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.5.15 Source cves: CVE-2026-25732 Source advisory: OSV:PYSEC-2026-95...

PYSEC-2026-95

NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOADDIR / file.name. Malicious filenames containing ../ sequences allow attackers to...

PYSEC-2026-95

NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOADDIR / file.name. Malicious filenames containing ../ sequences allow attackers to...

CVE-2026-25516 NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content

NiceGUI is a Python-based UI framework. The ui.markdown component uses the markdown2 library to convert markdown content to HTML, which is then rendered via innerHTML. By default, markdown2 allows raw HTML to pass through unchanged. This means that if an application renders user-controlled conten...

CVE-2026-25516 NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content

NiceGUI is a Python-based UI framework. The ui.markdown component uses the markdown2 library to convert markdown content to HTML, which is then rendered via innerHTML. By default, markdown2 allows raw HTML to pass through unchanged. This means that if an application renders user-controlled conten...

CVE-2026-25516

CVE-2026-25516 affects NiceGUI’s ui.markdown() in multiple sources (NVD, Red Hat, OSV, etc.). The vulnerability arises because markdown2’s default behavior allows raw HTML to pass through, enabling attacker-controlled content to inject HTML/JS event handlers when rendered via innerHTML. ui.markdo...

EUVD-2026-5566

NiceGUI is a Python-based UI framework. The ui.markdown component uses the markdown2 library to convert markdown content to HTML, which is then rendered via innerHTML. By default, markdown2 allows raw HTML to pass through unchanged. This means that if an application renders user-controlled conten...