nicegui

Summary

Two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. There is no impact to confidentiality or integrity.

Details

The affected routes are the per-component resource route (added in v1.4.6) and the ESM module route (added in v3.0.0). Both join a user-supplied path segment with a registered base directory and pass the result to FileResponse. The existing existence check uses pathlib.Path.exists(), which returns True for directories — so a request whose sub-path resolves to a directory passes the guard and triggers an unhandled exception inside Starlette.

FastAPI has no default handler for RuntimeError, so each such request results in a 500 response and a multi-frame traceback in the server log.

Other NiceGUI-served paths (/static/..., /components/..., /libraries/...) are not affected; they do not use the same sub-path-to-FileResponse pattern.

Impact

A remote, unauthenticated attacker can repeatedly trigger the error condition with crafted requests. Each request emits roughly 100 lines of traceback in a default setup, and more when additional middleware layers are present. At sustained request rates this can:

• exhaust disk space on hosts with default log retention,
• saturate downstream log-shipping pipelines,
• generate alert fatigue or mask other events in monitoring.

There is no remote code execution, no path traversal, and no data exposure beyond the absolute installation path that already appears in any uncaught exception trace.

Workarounds

For deployments that cannot upgrade immediately:

• Place NiceGUI behind a reverse proxy that rejects requests where the path after /_nicegui/<version>/esm/<key>/ or /_nicegui/<version>/resources/<key>/ is empty.
• Rate-limit the /_nicegui/ prefix at the proxy.
• Configure log rotation aggressively for the affected service.

Summary

ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives.

When a NiceGUI application passes attacker-controlled content to ui.restructured_text(), an attacker can use standard Docutils directives (include, csv-table with :file:, raw with :file:) to read local files readable by the NiceGUI server process.

Applications that only pass trusted static strings to ui.restructured_text() are not affected.

Details

The affected component is the reStructuredText renderer:

• File: nicegui/elements/restructured_text.py
• Function: prepare_content()

prepare_content() renders user-supplied reStructuredText through Docutils:

html = publish_parts(
    remove_indentation(content),
    writer_name='html4',
    settings_overrides={'syntax_highlight': 'short'},
)

The Docutils call only sets syntax_highlight. It does not disable file insertion or raw directives, so Docutils processes directives that read local files and embed their contents into the generated HTML before it is returned to the browser. Frontend sanitization cannot prevent this because the file has already been read server-side.

A minimal vulnerable usage pattern is any page that forwards untrusted input into ui.restructured_text(), e.g. content taken from query parameters, form fields, or other user-controlled sources.

Impact

Local file disclosure. An attacker who can supply reStructuredText content can read files accessible to the NiceGUI server process. Depending on deployment, this may expose:

• application .env files
• database URLs, API tokens, session/storage secrets
• OAuth or cloud credentials
• Docker or Kubernetes mounted secrets
• application source files
• logs and other process-readable files

The confirmed impact is confidentiality loss through arbitrary local file read. Applications are only impacted when they pass untrusted or user-controlled reStructuredText into ui.restructured_text().

Recommended fix

Disable unsafe Docutils features in prepare_content():

html = publish_parts(
    remove_indentation(content),
    writer_name='html4',
    settings_overrides={
        'syntax_highlight': 'short',
        'file_insertion_enabled': False,
        'raw_enabled': False,
        '_disable_config': True,
    },
)

This blocks the include, csv-table :file:, and raw :file: directives as well as local docutils.conf overrides.

Summary

Two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. There is no impact to confidentiality or integrity.

Details

The affected routes are the per-component resource route (added in v1.4.6) and the ESM module route (added in v3.0.0). Both join a user-supplied path segment with a registered base directory and pass the result to FileResponse. The existing existence check uses pathlib.Path.exists(), which returns True for directories — so a request whose sub-path resolves to a directory passes the guard and triggers an unhandled exception inside Starlette.

FastAPI has no default handler for RuntimeError, so each such request results in a 500 response and a multi-frame traceback in the server log.

Other NiceGUI-served paths (/static/..., /components/..., /libraries/...) are not affected; they do not use the same sub-path-to-FileResponse pattern.

Impact

A remote, unauthenticated attacker can repeatedly trigger the error condition with crafted requests. Each request emits roughly 100 lines of traceback in a default setup, and more when additional middleware layers are present. At sustained request rates this can:

• exhaust disk space on hosts with default log retention,
• saturate downstream log-shipping pipelines,
• generate alert fatigue or mask other events in monitoring.

There is no remote code execution, no path traversal, and no data exposure beyond the absolute installation path that already appears in any uncaught exception trace.

Workarounds

For deployments that cannot upgrade immediately:

• Place NiceGUI behind a reverse proxy that rejects requests where the path after /_nicegui/<version>/esm/<key>/ or /_nicegui/<version>/resources/<key>/ is empty.
• Rate-limit the /_nicegui/ prefix at the proxy.
• Configure log rotation aggressively for the affected service.

Summary

ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives.

When a NiceGUI application passes attacker-controlled content to ui.restructured_text(), an attacker can use standard Docutils directives (include, csv-table with :file:, raw with :file:) to read local files readable by the NiceGUI server process.

Applications that only pass trusted static strings to ui.restructured_text() are not affected.

Details

The affected component is the reStructuredText renderer:

• File: nicegui/elements/restructured_text.py
• Function: prepare_content()

prepare_content() renders user-supplied reStructuredText through Docutils:

html = publish_parts(
    remove_indentation(content),
    writer_name='html4',
    settings_overrides={'syntax_highlight': 'short'},
)

The Docutils call only sets syntax_highlight. It does not disable file insertion or raw directives, so Docutils processes directives that read local files and embed their contents into the generated HTML before it is returned to the browser. Frontend sanitization cannot prevent this because the file has already been read server-side.

A minimal vulnerable usage pattern is any page that forwards untrusted input into ui.restructured_text(), e.g. content taken from query parameters, form fields, or other user-controlled sources.

Impact

Local file disclosure. An attacker who can supply reStructuredText content can read files accessible to the NiceGUI server process. Depending on deployment, this may expose:

• application .env files
• database URLs, API tokens, session/storage secrets
• OAuth or cloud credentials
• Docker or Kubernetes mounted secrets
• application source files
• logs and other process-readable files

The confirmed impact is confidentiality loss through arbitrary local file read. Applications are only impacted when they pass untrusted or user-controlled reStructuredText into ui.restructured_text().

Recommended fix

Disable unsafe Docutils features in prepare_content():

html = publish_parts(
    remove_indentation(content),
    writer_name='html4',
    settings_overrides={
        'syntax_highlight': 'short',
        'file_insertion_enabled': False,
        'raw_enabled': False,
        '_disable_config': True,
    },
)

This blocks the include, csv-table :file:, and raw :file: directives as well as local docutils.conf overrides.

Summary

Two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. There is no impact to confidentiality or integrity.

Details

The affected routes are the per-component resource route (added in v1.4.6) and the ESM module route (added in v3.0.0). Both join a user-supplied path segment with a registered base directory and pass the result to FileResponse. The existing existence check uses pathlib.Path.exists(), which returns True for directories — so a request whose sub-path resolves to a directory passes the guard and triggers an unhandled exception inside Starlette.

FastAPI has no default handler for RuntimeError, so each such request results in a 500 response and a multi-frame traceback in the server log.

Other NiceGUI-served paths (/static/..., /components/..., /libraries/...) are not affected; they do not use the same sub-path-to-FileResponse pattern.

Impact

A remote, unauthenticated attacker can repeatedly trigger the error condition with crafted requests. Each request emits roughly 100 lines of traceback in a default setup, and more when additional middleware layers are present. At sustained request rates this can:

• exhaust disk space on hosts with default log retention,
• saturate downstream log-shipping pipelines,
• generate alert fatigue or mask other events in monitoring.

There is no remote code execution, no path traversal, and no data exposure beyond the absolute installation path that already appears in any uncaught exception trace.

Workarounds

For deployments that cannot upgrade immediately:

• Place NiceGUI behind a reverse proxy that rejects requests where the path after /_nicegui/<version>/esm/<key>/ or /_nicegui/<version>/resources/<key>/ is empty.
• Rate-limit the /_nicegui/ prefix at the proxy.
• Configure log rotation aggressively for the affected service.

Summary

ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives.

When a NiceGUI application passes attacker-controlled content to ui.restructured_text(), an attacker can use standard Docutils directives (include, csv-table with :file:, raw with :file:) to read local files readable by the NiceGUI server process.

Applications that only pass trusted static strings to ui.restructured_text() are not affected.

Details

The affected component is the reStructuredText renderer:

• File: nicegui/elements/restructured_text.py
• Function: prepare_content()

prepare_content() renders user-supplied reStructuredText through Docutils:

html = publish_parts(
    remove_indentation(content),
    writer_name='html4',
    settings_overrides={'syntax_highlight': 'short'},
)

The Docutils call only sets syntax_highlight. It does not disable file insertion or raw directives, so Docutils processes directives that read local files and embed their contents into the generated HTML before it is returned to the browser. Frontend sanitization cannot prevent this because the file has already been read server-side.

A minimal vulnerable usage pattern is any page that forwards untrusted input into ui.restructured_text(), e.g. content taken from query parameters, form fields, or other user-controlled sources.

Impact

Local file disclosure. An attacker who can supply reStructuredText content can read files accessible to the NiceGUI server process. Depending on deployment, this may expose:

• application .env files
• database URLs, API tokens, session/storage secrets
• OAuth or cloud credentials
• Docker or Kubernetes mounted secrets
• application source files
• logs and other process-readable files

The confirmed impact is confidentiality loss through arbitrary local file read. Applications are only impacted when they pass untrusted or user-controlled reStructuredText into ui.restructured_text().

Recommended fix

Disable unsafe Docutils features in prepare_content():

html = publish_parts(
    remove_indentation(content),
    writer_name='html4',
    settings_overrides={
        'syntax_highlight': 'short',
        'file_insertion_enabled': False,
        'raw_enabled': False,
        '_disable_config': True,
    },
)

This blocks the include, csv-table :file:, and raw :file: directives as well as local docutils.conf overrides.

Summary

Two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. There is no impact to confidentiality or integrity.

Details

The affected routes are the per-component resource route (added in v1.4.6) and the ESM module route (added in v3.0.0). Both join a user-supplied path segment with a registered base directory and pass the result to FileResponse. The existing existence check uses pathlib.Path.exists(), which returns True for directories — so a request whose sub-path resolves to a directory passes the guard and triggers an unhandled exception inside Starlette.

FastAPI has no default handler for RuntimeError, so each such request results in a 500 response and a multi-frame traceback in the server log.

Other NiceGUI-served paths (/static/..., /components/..., /libraries/...) are not affected; they do not use the same sub-path-to-FileResponse pattern.

Impact

A remote, unauthenticated attacker can repeatedly trigger the error condition with crafted requests. Each request emits roughly 100 lines of traceback in a default setup, and more when additional middleware layers are present. At sustained request rates this can:

• exhaust disk space on hosts with default log retention,
• saturate downstream log-shipping pipelines,
• generate alert fatigue or mask other events in monitoring.

There is no remote code execution, no path traversal, and no data exposure beyond the absolute installation path that already appears in any uncaught exception trace.

Workarounds

For deployments that cannot upgrade immediately:

• Place NiceGUI behind a reverse proxy that rejects requests where the path after /_nicegui/<version>/esm/<key>/ or /_nicegui/<version>/resources/<key>/ is empty.
• Rate-limit the /_nicegui/ prefix at the proxy.
• Configure log rotation aggressively for the affected service.

Summary

ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives.

When a NiceGUI application passes attacker-controlled content to ui.restructured_text(), an attacker can use standard Docutils directives (include, csv-table with :file:, raw with :file:) to read local files readable by the NiceGUI server process.

Applications that only pass trusted static strings to ui.restructured_text() are not affected.

Details

The affected component is the reStructuredText renderer:

• File: nicegui/elements/restructured_text.py
• Function: prepare_content()

prepare_content() renders user-supplied reStructuredText through Docutils:

html = publish_parts(
    remove_indentation(content),
    writer_name='html4',
    settings_overrides={'syntax_highlight': 'short'},
)

The Docutils call only sets syntax_highlight. It does not disable file insertion or raw directives, so Docutils processes directives that read local files and embed their contents into the generated HTML before it is returned to the browser. Frontend sanitization cannot prevent this because the file has already been read server-side.

A minimal vulnerable usage pattern is any page that forwards untrusted input into ui.restructured_text(), e.g. content taken from query parameters, form fields, or other user-controlled sources.

Impact

Local file disclosure. An attacker who can supply reStructuredText content can read files accessible to the NiceGUI server process. Depending on deployment, this may expose:

• application .env files
• database URLs, API tokens, session/storage secrets
• OAuth or cloud credentials
• Docker or Kubernetes mounted secrets
• application source files
• logs and other process-readable files

The confirmed impact is confidentiality loss through arbitrary local file read. Applications are only impacted when they pass untrusted or user-controlled reStructuredText into ui.restructured_text().

Recommended fix

Disable unsafe Docutils features in prepare_content():

html = publish_parts(
    remove_indentation(content),
    writer_name='html4',
    settings_overrides={
        'syntax_highlight': 'short',
        'file_insertion_enabled': False,
        'raw_enabled': False,
        '_disable_config': True,
    },
)

This blocks the include, csv-table :file:, and raw :file: directives as well as local docutils.conf overrides.

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes () in the upload filename. Applications that construct file paths using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. This vulnerability is fixed in 3.10.0.

Summary

Two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. There is no impact to confidentiality or integrity.

Details

The affected routes are the per-component resource route (added in v1.4.6) and the ESM module route (added in v3.0.0). Both join a user-supplied path segment with a registered base directory and pass the result to FileResponse. The existing existence check uses pathlib.Path.exists(), which returns True for directories — so a request whose sub-path resolves to a directory passes the guard and triggers an unhandled exception inside Starlette.

FastAPI has no default handler for RuntimeError, so each such request results in a 500 response and a multi-frame traceback in the server log.

Other NiceGUI-served paths (/static/..., /components/..., /libraries/...) are not affected; they do not use the same sub-path-to-FileResponse pattern.

Impact

A remote, unauthenticated attacker can repeatedly trigger the error condition with crafted requests. Each request emits roughly 100 lines of traceback in a default setup, and more when additional middleware layers are present. At sustained request rates this can:

• exhaust disk space on hosts with default log retention,
• saturate downstream log-shipping pipelines,
• generate alert fatigue or mask other events in monitoring.

There is no remote code execution, no path traversal, and no data exposure beyond the absolute installation path that already appears in any uncaught exception trace.

Workarounds

For deployments that cannot upgrade immediately:

• Place NiceGUI behind a reverse proxy that rejects requests where the path after /_nicegui/<version>/esm/<key>/ or /_nicegui/<version>/resources/<key>/ is empty.
• Rate-limit the /_nicegui/ prefix at the proxy.
• Configure log rotation aggressively for the affected service.

Summary

ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives.

When a NiceGUI application passes attacker-controlled content to ui.restructured_text(), an attacker can use standard Docutils directives (include, csv-table with :file:, raw with :file:) to read local files readable by the NiceGUI server process.

Applications that only pass trusted static strings to ui.restructured_text() are not affected.

Details

The affected component is the reStructuredText renderer:

• File: nicegui/elements/restructured_text.py
• Function: prepare_content()

prepare_content() renders user-supplied reStructuredText through Docutils:

html = publish_parts(
    remove_indentation(content),
    writer_name='html4',
    settings_overrides={'syntax_highlight': 'short'},
)

The Docutils call only sets syntax_highlight. It does not disable file insertion or raw directives, so Docutils processes directives that read local files and embed their contents into the generated HTML before it is returned to the browser. Frontend sanitization cannot prevent this because the file has already been read server-side.

A minimal vulnerable usage pattern is any page that forwards untrusted input into ui.restructured_text(), e.g. content taken from query parameters, form fields, or other user-controlled sources.

Impact

Local file disclosure. An attacker who can supply reStructuredText content can read files accessible to the NiceGUI server process. Depending on deployment, this may expose:

• application .env files
• database URLs, API tokens, session/storage secrets
• OAuth or cloud credentials
• Docker or Kubernetes mounted secrets
• application source files
• logs and other process-readable files

The confirmed impact is confidentiality loss through arbitrary local file read. Applications are only impacted when they pass untrusted or user-controlled reStructuredText into ui.restructured_text().

Recommended fix

Disable unsafe Docutils features in prepare_content():

html = publish_parts(
    remove_indentation(content),
    writer_name='html4',
    settings_overrides={
        'syntax_highlight': 'short',
        'file_insertion_enabled': False,
        'raw_enabled': False,
        '_disable_config': True,
    },
)

This blocks the include, csv-table :file:, and raw :file: directives as well as local docutils.conf overrides.

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes () in the upload filename. Applications that construct file paths using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. This vulnerability is fixed in 3.10.0.

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and force the server to load entire files into memory at once. With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service. This issue has been patched in version 3.9.0.

Summary

Two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. There is no impact to confidentiality or integrity.

Details

The affected routes are the per-component resource route (added in v1.4.6) and the ESM module route (added in v3.0.0). Both join a user-supplied path segment with a registered base directory and pass the result to FileResponse. The existing existence check uses pathlib.Path.exists(), which returns True for directories — so a request whose sub-path resolves to a directory passes the guard and triggers an unhandled exception inside Starlette.

FastAPI has no default handler for RuntimeError, so each such request results in a 500 response and a multi-frame traceback in the server log.

Other NiceGUI-served paths (/static/..., /components/..., /libraries/...) are not affected; they do not use the same sub-path-to-FileResponse pattern.

Impact

A remote, unauthenticated attacker can repeatedly trigger the error condition with crafted requests. Each request emits roughly 100 lines of traceback in a default setup, and more when additional middleware layers are present. At sustained request rates this can:

• exhaust disk space on hosts with default log retention,
• saturate downstream log-shipping pipelines,
• generate alert fatigue or mask other events in monitoring.

There is no remote code execution, no path traversal, and no data exposure beyond the absolute installation path that already appears in any uncaught exception trace.

Workarounds

For deployments that cannot upgrade immediately:

• Place NiceGUI behind a reverse proxy that rejects requests where the path after /_nicegui/<version>/esm/<key>/ or /_nicegui/<version>/resources/<key>/ is empty.
• Rate-limit the /_nicegui/ prefix at the proxy.
• Configure log rotation aggressively for the affected service.

Summary

ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives.

When a NiceGUI application passes attacker-controlled content to ui.restructured_text(), an attacker can use standard Docutils directives (include, csv-table with :file:, raw with :file:) to read local files readable by the NiceGUI server process.

Applications that only pass trusted static strings to ui.restructured_text() are not affected.

Details

The affected component is the reStructuredText renderer:

• File: nicegui/elements/restructured_text.py
• Function: prepare_content()

prepare_content() renders user-supplied reStructuredText through Docutils:

html = publish_parts(
    remove_indentation(content),
    writer_name='html4',
    settings_overrides={'syntax_highlight': 'short'},
)

The Docutils call only sets syntax_highlight. It does not disable file insertion or raw directives, so Docutils processes directives that read local files and embed their contents into the generated HTML before it is returned to the browser. Frontend sanitization cannot prevent this because the file has already been read server-side.

A minimal vulnerable usage pattern is any page that forwards untrusted input into ui.restructured_text(), e.g. content taken from query parameters, form fields, or other user-controlled sources.

Impact

Local file disclosure. An attacker who can supply reStructuredText content can read files accessible to the NiceGUI server process. Depending on deployment, this may expose:

• application .env files
• database URLs, API tokens, session/storage secrets
• OAuth or cloud credentials
• Docker or Kubernetes mounted secrets
• application source files
• logs and other process-readable files

The confirmed impact is confidentiality loss through arbitrary local file read. Applications are only impacted when they pass untrusted or user-controlled reStructuredText into ui.restructured_text().

Recommended fix

Disable unsafe Docutils features in prepare_content():

html = publish_parts(
    remove_indentation(content),
    writer_name='html4',
    settings_overrides={
        'syntax_highlight': 'short',
        'file_insertion_enabled': False,
        'raw_enabled': False,
        '_disable_config': True,
    },
)

This blocks the include, csv-table :file:, and raw :file: directives as well as local docutils.conf overrides.

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes () in the upload filename. Applications that construct file paths using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. This vulnerability is fixed in 3.10.0.

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and force the server to load entire files into memory at once. With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service. This issue has been patched in version 3.9.0.

Summary

Several NiceGUI APIs that execute methods on client-side elements (Element.run_method(), AgGrid.run_grid_method(), EChart.run_chart_method(), and others) use an eval() fallback in the JavaScript-side runMethod() function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser.

Additionally, Element.run_method() and Element.get_computed_prop() used string interpolation instead of json.dumps() for the method/property name, allowing quote injection to break out of the intended string context.

Attack Vector

An attacker crafts a malicious URL with a payload as a query parameter. If the application passes this parameter as a method name to any of the affected APIs, the payload is sent to the client via WebSocket and executed via eval().

Example: /?method=alert(document.cookie) combined with application code like:

element.run_method(user_provided_method_name)

Impact

• Cookie/token theft
• DOM manipulation (phishing, fake login forms)
• Actions performed as the victim user

Affected Methods

1. Element.run_method()
2. Element.get_computed_prop()
3. AgGrid.run_grid_method()
4. AgGrid.run_row_method()
5. EChart.run_chart_method()
6. JsonEditor.run_editor_method()
7. Xterm.run_terminal_method()
8. Leaflet.run_map_method()
9. Leaflet.run_layer_method()
10. LeafletLayer.run_method()

Fix

1. Use json.dumps() for proper escaping of method/property names in run_method() and get_computed_prop()
2. Remove the eval() fallback from runMethod() in nicegui.js — method names that are not found on the element now raise an error instead of being evaluated as arbitrary JavaScript

Migration

Code that previously passed JavaScript functions as method names needs to use ui.run_javascript() instead:

# Before:
row = await grid.run_grid_method('g => g.getDisplayedRowAtIndex(0).data')

# After:
row = await ui.run_javascript(f'return getElement({grid.id}).api.getDisplayedRowAtIndex(0).data')

Summary

Two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. There is no impact to confidentiality or integrity.

Details

The affected routes are the per-component resource route (added in v1.4.6) and the ESM module route (added in v3.0.0). Both join a user-supplied path segment with a registered base directory and pass the result to FileResponse. The existing existence check uses pathlib.Path.exists(), which returns True for directories — so a request whose sub-path resolves to a directory passes the guard and triggers an unhandled exception inside Starlette.

FastAPI has no default handler for RuntimeError, so each such request results in a 500 response and a multi-frame traceback in the server log.

Other NiceGUI-served paths (/static/..., /components/..., /libraries/...) are not affected; they do not use the same sub-path-to-FileResponse pattern.

Impact

A remote, unauthenticated attacker can repeatedly trigger the error condition with crafted requests. Each request emits roughly 100 lines of traceback in a default setup, and more when additional middleware layers are present. At sustained request rates this can:

• exhaust disk space on hosts with default log retention,
• saturate downstream log-shipping pipelines,
• generate alert fatigue or mask other events in monitoring.