CVE-2023-33175

CriticalCVSS 9.1

Published: 30/05/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.65%

46th percentile - higher than 46% of all known CVEs

Summary

ToUI is a Python package for creating user interfaces that uses Flask-Caching to store user variables. Versions 2.0.1 to 2.4.0 are affected by an issue with the `Website.user_vars` property. This issue has been patched in version 2.4.1.

Risk Assessment

Organizations using the affected versions may be exposed to unauthorized access to user variables, potentially leading to data leakage.

Recommendation

It is recommended to update the ToUI package to version 2.4.1 or later to mitigate this vulnerability.

Original NVD description (English source)

ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1.