Evnchn

**Name of the Vulnerable Software and Affected Versions** NiceGUI versions prior to 3.12.0 **Description** Two FastAPI routes used for serving per-component static assets accept a sub-path parameter that can resolve to a directory instead of a file. When a request resolves to a directory, it triggers an unhandled `RuntimeError` within Starlette's `FileResponse` function, causing Uvicorn to write a full traceback to the server log. Since these routes are accessible without authentication, a remote attacker can send crafted requests to amplify log volume, potentially exhausting disk space, saturating log-shipping pipelines, and causing alert fatigue. The affected endpoints are the resource route and the ESM module route, specifically where user-supplied path segments are joined with a registered base directory. This issue does not result in remote code execution, path traversal, or data exposure. **Recommendations** Update to version 3.12.0. As a temporary workaround, place the software behind a reverse proxy to reject requests where the path after `/ nicegui/<version>/esm/<key>/` or `/ nicegui/<version>/resources/<key>/` is empty. Rate-limit the `/ nicegui/` prefix at the proxy level. Configure aggressive log rotation for the affected service.

**Name of the Vulnerable Software and Affected Versions** NiceGUI versions 2.22.0 through 3.4.1 **Description** NiceGUI is a Python-based UI framework susceptible to a cross-site scripting (XSS) issue. The problem stems from an unsafe implementation within the click event listener used by `ui.sub pages`, coupled with the rendering of attacker-controlled links on the page. When a user clicks on such a link, XSS can occur. The issue involves the `ui.sub pages` function and the handling of links. **Recommendations** Upgrade to NiceGUI version 3.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** NiceGUI versions 2.22.0 through 3.4.1 **Description** NiceGUI is a Python-based UI framework. An unsafe implementation in the pushstate event listener used by `ui.sub pages` allows an attacker to manipulate the fragment identifier of the URL, even from a different site, using an iframe. This manipulation is possible due to a flaw in how the framework handles URL fragment changes within sub-pages. The `pushstate` event listener is the component responsible for managing the browser's history state, and its improper implementation allows for cross-site manipulation. **Recommendations** Upgrade to NiceGUI version 3.5.0 or later to resolve this issue.