File Inclusion Vulnerability in NiceGUI Framework by Zauberzeug
CVE-2026-45553

7.5HIGH

Key Information:

Vendor

Zauberzeug

Status
Nicegui
Vendor
CVE Published:
2 June 2026

What is CVE-2026-45553?

The NiceGUI framework, used for creating user interfaces in Python, has a vulnerability that allows for file inclusion via the ui.restructured_text() method. This occurs when the method processes attacker-controlled content without properly disabling file insertion directives through Docutils, enabling potential access to local files on the server. Applications can mitigate this risk by ensuring that only trusted static strings are passed to ui.restructured_text(). A patch addressing this issue has been released in version 3.12.0.

Affected Version(s)

nicegui < 3.12.0

References

https://github.com/zauberzeug/nicegui/security/advisories...
x_refsource_CONFIRM
https://github.com/zauberzeug/nicegui/releases/tag/v3.12.0
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.