GHSA-jfrm-rx66-g536

Suggest an improvement
Source
https://github.com/advisories/GHSA-jfrm-rx66-g536
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jfrm-rx66-g536/GHSA-jfrm-rx66-g536.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jfrm-rx66-g536
Aliases
Published
2026-05-18T20:21:59Z
Modified
2026-07-13T16:43:04Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
Details

Summary

ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives.

When a NiceGUI application passes attacker-controlled content to ui.restructured_text(), an attacker can use standard Docutils directives (include, csv-table with :file:, raw with :file:) to read local files readable by the NiceGUI server process.

Applications that only pass trusted static strings to ui.restructured_text() are not affected.

Details

The affected component is the reStructuredText renderer:

  • File: nicegui/elements/restructured_text.py
  • Function: prepare_content()

prepare_content() renders user-supplied reStructuredText through Docutils:

html = publish_parts(
    remove_indentation(content),
    writer_name='html4',
    settings_overrides={'syntax_highlight': 'short'},
)

The Docutils call only sets syntax_highlight. It does not disable file insertion or raw directives, so Docutils processes directives that read local files and embed their contents into the generated HTML before it is returned to the browser. Frontend sanitization cannot prevent this because the file has already been read server-side.

A minimal vulnerable usage pattern is any page that forwards untrusted input into ui.restructured_text(), e.g. content taken from query parameters, form fields, or other user-controlled sources.

Impact

Local file disclosure. An attacker who can supply reStructuredText content can read files accessible to the NiceGUI server process. Depending on deployment, this may expose:

  • application .env files
  • database URLs, API tokens, session/storage secrets
  • OAuth or cloud credentials
  • Docker or Kubernetes mounted secrets
  • application source files
  • logs and other process-readable files

The confirmed impact is confidentiality loss through arbitrary local file read. Applications are only impacted when they pass untrusted or user-controlled reStructuredText into ui.restructured_text().

Recommended fix

Disable unsafe Docutils features in prepare_content():

html = publish_parts(
    remove_indentation(content),
    writer_name='html4',
    settings_overrides={
        'syntax_highlight': 'short',
        'file_insertion_enabled': False,
        'raw_enabled': False,
        '_disable_config': True,
    },
)

This blocks the include, csv-table :file:, and raw :file: directives as well as local docutils.conf overrides.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T20:21:59Z",
    "nvd_published_at": "2026-06-02T16:16:41Z",
    "severity": "HIGH"
}
References

Affected packages

PyPI / nicegui

Package

Name
nicegui
View open source insights on deps.dev
Purl
pkg:pypi/nicegui

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.12.0

Affected versions

0.*
0.1.0
0.1.4
0.1.6
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.9
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.2.15
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.3.9
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.4.10
0.4.11
0.4.12
0.4.13
0.4.14
0.4.15
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.8
0.5.9
0.5.10
0.5.11
0.5.12
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.6.10
0.6.11
0.6.12
0.6.13
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.6
0.7.7
0.7.8
0.7.9
0.7.10
0.7.11
0.7.12
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.21
0.7.22
0.7.23
0.7.24
0.7.25
0.7.26
0.7.27
0.7.28
0.7.29
0.7.30
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.8.10
0.8.11
0.8.12
0.8.13
0.8.14
0.8.15
0.8.16
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
1.*
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.1.10
1.1.11
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.2.10
1.2.11
1.2.12
1.2.13
1.2.14
1.2.15
1.2.16
1.2.17
1.2.18
1.2.20
1.2.21
1.2.22
1.2.23
1.2.24
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.9
1.3.10
1.3.11
1.3.12
1.3.13
1.3.14
1.3.15
1.3.16
1.3.17
1.3.18
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.4.10
1.4.11
1.4.12
1.4.13
1.4.14
1.4.15
1.4.16
1.4.17
1.4.18
1.4.19
1.4.20
1.4.21
1.4.22
1.4.23
1.4.24
1.4.25
1.4.26
1.4.27
1.4.28
1.4.29
1.4.30
1.4.31
1.4.33
1.4.34
1.4.35
1.4.36
1.4.37
2.*
2.0.0
2.0.1
2.1.0
2.2.0
2.3.0
2.4.0
2.5.0
2.7.0
2.8.0
2.8.1
2.9.0
2.9.1
2.10.0
2.10.1
2.11.0
2.11.1
2.12.0
2.12.1
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.16.1
2.17.0
2.18.0
2.19.0
2.20.0
2.21.0
2.21.1
2.22.0
2.22.1
2.22.2
2.23.0
2.23.1
2.23.2
2.23.3
2.24.0
2.24.1
2.24.2
3.*
3.0.0rc1
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.6.0
3.6.1
3.7.0
3.7.1
3.8.0
3.9.0
3.10.0
3.11.0
3.11.1

Database specific

last_known_affected_version_range 
"<= 3.11.1"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jfrm-rx66-g536/GHSA-jfrm-rx66-g536.json"