PyPI/nicegui CVE-2026-33332: high 7.5, EPSS 0.62%
NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled query parameter that influences how files
Action: Upgrade nicegui to 3.9.0 or later.
pip install nicegui==3.9.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.9.0 | - |
Fixed versions
| 3.9.0 |
Sources
- osv: PYSEC-2026-2233
- https://github.com/zauberzeug/nicegui/releases/tag/v3.9.0
- https://github.com/zauberzeug/nicegui/security/advisories/GHSA-w5g8-5849-vj76
- https://github.com/zauberzeug/nicegui/commit/9026962b8c4f3f225c98b2fbc35aa6b60cb3495b
CVE-2026-33332 · published · modified · JSON