PT-2026-41235 · Nicegui · Nicegui

Dennyabrahamsinaga + 1 · Published 2026-05-14 · Updated 2026-06-02 · CVE-2026-45553

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NiceGUI (affected versions not specified)

Description The ui.restructured text() function renders reStructuredText server-side using Docutils without disabling file insertion directives. When attacker-controlled content is passed to this function, an attacker can use standard Docutils directives such as include, csv-table with :file:, or raw with :file: to read local files accessible by the server process. This occurs within the prepare content() function located in nicegui/elements/restructured text.py, which fails to disable file insertion or raw directives during the rendering process. This can lead to the disclosure of sensitive information, including environment files, database URLs, API tokens, and source files.

Recommendations Disable unsafe Docutils features in the prepare content() function by setting file insertion enabled to False, raw enabled to False, and disable config to True within the settings overrides parameter. As a temporary workaround, avoid passing untrusted or user-controlled input into the ui.restructured text() function.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-45553

GHSA-JFRM-RX66-G536

Affected Products

Nicegui

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-45553 · Security Note
• https://osv.dev/vulnerability/GHSA-jfrm-rx66-g536 · Vendor Advisory
• https://github.com/zauberzeug/nicegui/releases/tag/v3.12.0 · Note
• https://github.com/zauberzeug/nicegui · Note
• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-jfrm-rx66-g536 · Note
• https://twitter.com/h3ri0s/status/2054992350813012371 · Twitter Post