How severe is CVE-2023-33175?

CVE-2023-33175 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2023-33175 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-33175?

CVE-2023-33175 affects Toui Project Toui. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-33175?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2023-33175 published?

CVE-2023-33175 was published on 2023-05-30 and last updated on 2026-06-17.

CVE-2023-33175

CVE-2023-33175 is a critical-severity vulnerability in Toui Project Toui with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-913.

Key facts

Severity: Critical (CVSS 3.x base score 9.1)
EPSS exploit prediction: 1% (50th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-913
Affected product: Toui Project Toui
Published: 2023-05-30
Last modified: 2026-06-17

Description

ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1.

Frequently asked questions

What is CVE-2023-33175?: ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1.
How severe is CVE-2023-33175?: CVE-2023-33175 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2023-33175 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-33175?: CVE-2023-33175 affects Toui Project Toui. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-33175?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2023-33175 published?: CVE-2023-33175 was published on 2023-05-30 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:toui_project:toui:*:*:*:*:*:*:*:*

Other CWE-913 vulnerabilities

CVE-2026-92955 — Critical (CVSS 10.0): vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__…
CVE-2026-92953 — Critical (CVSS 10.0): vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox…
CVE-2026-92946 — Critical (CVSS 10.0): vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit…
CVE-2026-47208 — Critical (CVSS 10.0): vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout…
CVE-2026-47137 — Critical (CVSS 10.0): vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903)…
CVE-2026-47131 — Critical (CVSS 10.0): vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining…

Browse all CWE-913 vulnerabilities →