Zauberzeug vulnerabilities
We track 7 vulnerabilities in Zauberzeug products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on June 2, 2026.
Latest Zauberzeug vulnerabilities
- 7.5 High severity
nicegui: Exposure of Sensitive Information to an Unauthorized Actor
NiceGUI is a Python-based UI framework. Prior to version 3.12.0, ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives. When a NiceGUI application passes attacker-controlled content to ui.restruct
- 7.5 High severity
nicegui: Improper Limitation of a Pathname to a Restricted Directory
NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (\) in the upload filename. Applications that construc
- 7.5 High severity
NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file()…
NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the r
- 7.5 High severity
nicegui: Improper Limitation of a Pathname to a Restricted Directory
NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames conta
- 7.5 High severity
nicegui: Improper Limitation of a Pathname to a Restricted Directory
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version 3
- 7.5 High severity
nicegui: Improper Authentication
NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in incognito mode. This vulnerability is fixed in 2.9.1.
- 8.2 High severity
nicegui: Improper Limitation of a Pathname to a Restricted Directory
NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the `/_nicegui/{__version__}/resources/{key}/{path:path}` route. As a result any file on the backend fi