NiceUI Leaflet Component Vulnerability

CVE-2024-32005

What is CVE-2024-32005?

The vulnerability affects the NiceGUI framework, specifically in the leaflet component, which allows for local file inclusion. It occurs when resource files are requested through the route /_nicegui/{__version__}/resources/{key}/{path:path}. An attacker able to access the NiceUI leaflet website can exploit this vulnerability to read sensitive files available on the backend filesystem, as the web server has the necessary permissions. The issue has been addressed in NiceGUI version 1.4.21, and users are strongly encouraged to update to this version or later to mitigate potential risks. No workarounds exist for this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References