CVE-2025-21618

Advisory

A security vulnerability was discovered in the nicegui library. The vulnerability allowed browser storage, such as cookies, to be shared across clients when accessing the application via "On Air". This could lead to sensitive information leakage or unauthorized access to user-specific data. The vulnerability has been addressed by clearing the cookies after each request.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Bugfixes

- Avoid browser storage being shared across clients when accessing via On Air ([GHSA-v6jv-p6r8-j78w](https://github.com/zauberzeug/nicegui/security/advisories/GHSA-v6jv-p6r8-j78w) by streamcfd, rodja)
- Fix closing tag in `ui.editor` (4148 by Alyxion)

Documentation

- Only create subheading if we have class docs (4126 by rodja)

Dependency

- Bump mypy from 1.13.0 to 1.14.0 (4130 by dependabot)

Resources

• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-v6jv-p6r8-j78w
• https://github.com/zauberzeug/nicegui/commit/343dc0da8de0cf2f645cf8b5d76f5b439cb817f3
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21618