https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T20:27:57.280097+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-45553 CVE-2026-45553 — NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text() 2026-10-06T20:27:57.295648+00:00

Affected: zauberzeug nicegui

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives. When a NiceGUI application passes attacker-controlled content to ui.restructured_text(), an attacker can use standard Docutils directives (include, csv-table with :file:, raw with :file:) to read local files readable by the NiceGUI server process. Applications that only pass trusted static strings to ui.restructured_text() are not affected. This issue has been patched in version 3.12.0.