Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in two FastAPI routes, _get_resource and _get_esm, which are responsible for serving per-component static assets. These routes accept a sub-path parameter that can be manipulated by a remote, unauthenticated attacker. The core of the vulnerability lies in the use of pathlib.Path.exists() to validate the existence of the requested resource. This function returns True for both files and directories. When a request is made for a path that resolves to a directory, the FileResponse from Starlette raises an unhandled RuntimeError. This error results in a detailed traceback being written to the server log for each malicious request. An attacker can exploit this by sending a high volume of such requests, leading to excessive log generation, which can fill up disk space, overwhelm log processing pipelines, and create noise in monitoring systems. The patch addresses this by replacing path.exists() with path.is_file(), ensuring that only file paths are processed and preventing the RuntimeError from being triggered by directory paths.
_get_resourcenicegui/nicegui.py
_get_esmnicegui/nicegui.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nicegui | pip | <= 3.11.1 | 3.12.0 |