CVE-2025-66470 Details
Description
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG <foreignObject> tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0.
A cross-site scripting (XSS) vulnerability has been identified in NiceGUI, a Python-based UI framework, affecting versions through 3.3.1. The issue arises in the 'ui.interactive_image' component, which renders SVG content using Vue's 'v-html' directive without proper sanitization. This flaw allows attackers to inject malicious HTML or JavaScript via the SVG '<foreignObject>' tag, particularly threatening dashboards or multi-user applications that display user-generated content or annotations.
Users can update to NiceGUI version 3.4.0 or later, where this vulnerability has been fixed. After updating, it is recommended to review the usage of the 'ui.interactive_image' component and specify a sanitization function for SVG content, especially if it includes user input.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 9, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zauberzeug/nicegui/security/advisories/GHSA-2m4f-cg75-76w2 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/zauberzeug/nicegui/commit/58ad0b36e19922de16bbc79ea3ddd29851b1a3e3 | [email protected] | Patch |
| https://github.com/zauberzeug/nicegui/security/advisories/GHSA-2m4f-cg75-76w2 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zauberzeug nicegui | < 3.4.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 11, 2025 | Initial Analysis | [email protected] |
| Dec 9, 2025 | CVE Modified | CISA-ADP |
| Dec 9, 2025 | New CVE Received | [email protected] |