CVE-2025-66469 Details
Description
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.add_css, ui.add_scss, and ui.add_sass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended <style> or <script> tags by injecting closing tags (e.g., </style> or </script>), allowing for the execution of arbitrary JavaScript. This issue is fixed in version 3.4.0.
A reflected cross-site scripting vulnerability has been identified in NiceGUI, a Python-based UI framework, affecting versions through 3.3.1. The issue arises in the 'ui.add_css', 'ui.add_scss', and 'ui.add_sass' functions, which lack proper sanitization for the JavaScript context they create. This allows an attacker to inject closing tags for '<style>' or '<script>' elements, escaping the intended context and executing arbitrary JavaScript. The vulnerability is particularly concerning in applications that use these functions to handle untrusted input, such as dynamic theming based on user-supplied data.
Users can upgrade to NiceGUI version 3.4.0, which addresses the vulnerability by properly encoding the content for the 'ui.add_css', 'ui.add_scss', and 'ui.add_sass' functions to prevent cross-site scripting.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 9, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zauberzeug/nicegui/security/advisories/GHSA-72qc-wxch-74mg | CISA-ADP | ExploitVendor Advisory |
| https://github.com/zauberzeug/nicegui/commit/a8fd25b7d5e23afb1952d0f60a1940e18b5f1ca8 | [email protected] | Patch |
| https://github.com/zauberzeug/nicegui/security/advisories/GHSA-72qc-wxch-74mg | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zauberzeug nicegui | < 3.4.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 11, 2025 | Initial Analysis | [email protected] |
| Dec 9, 2025 | CVE Modified | CISA-ADP |
| Dec 9, 2025 | New CVE Received | [email protected] |