CVE-2026-45553: NiceGUI Local File Disclosure via Docutils File Insertion
Summary
CVE-2026-45553: NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text(). Affects nicegui versions < 3.12.0. Fixed in 3.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NiceGUI is a Python library that simplifies the creation of user interfaces for web applications. It allows developers to build interactive applications using Python code, providing a range of UI components and features. However, a vulnerability exists in its reStructuredText rendering functionality, which can lead to local file disclosure if untrusted input is processed.
Vulnerability Detail
The vulnerability arises from the ui.restructured_text() function, which renders reStructuredText server-side using Docutils without disabling file insertion directives. This allows an attacker to exploit the function by injecting malicious reStructuredText content that includes directives like include or csv-table :file: to read local files accessible to the NiceGUI server process. The potential ramifications include exposure of sensitive information such as application configuration files, database credentials, and other confidential data, leading to a significant confidentiality breach.
How To Fix
Latest published version: 3.18.0 as of 22 Oct 2026
pip install --upgrade "nicegui==3.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.12.0
This is the first release that contains the fix.
pip install --upgrade "nicegui==3.12.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, avoid passing untrusted input to the ui.restructured_text() function. Ensure that only trusted static strings are used, and sanitize any user input before processing it.
Conclusion
The vulnerability CVE-2026-45553 in NiceGUI allows for local file disclosure through improper handling of reStructuredText input. It is crucial to update to the patched version or implement workarounds to mitigate the risk of exposing sensitive information.
See every vulnerability recorded for nicegui →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Files that could be exposed include application configuration files, database URLs, API tokens, OAuth credentials, and other sensitive files accessible to the NiceGUI server process.
No, this vulnerability is present in NiceGUI versions up to and including 3.11.1. It has been fixed in version 3.12.0 and later.
If you cannot update immediately, ensure that you do not pass untrusted input to the ui.restructured_text() function and sanitize any user input before processing.
References
Related vulnerabilities
Recent vulnerabilities recorded for nicegui.
