CVE-2025-66470
published 2025-12-09CVE-2025-66470: NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The…
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.22%
12.8th percentile
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zauberzeug | nicegui | < 3.4.0 | 3.4.0 |
| zauberzeug | nicegui | >= 0 < 3.4.0 | 3.4.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
osv·2025-12-08
CVE-2025-66470 [MEDIUM] NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
### Summary
A Cross-Site Scripting (XSS) vulnerability exists in the `ui.interactive_image` component of NiceGUI (v3.3.1 and earlier). The component renders SVG content using Vue's `v-html` directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG `` tag.
### Details
The vulnerability is located in `nicegui/elements/interactive_image.js`.
The component uses the following code to render content:
```javascript
```
Vue's v-html directive renders raw HTML strings into the DOM. If an application allows user-controlled input to be passed to the content property of an interactive image, an attacker can embed a tag containing malicious scripts, bypassing typical im
GHSA
NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
ghsa·2025-12-08
CVE-2025-66470 [MEDIUM] CWE-79 NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
### Summary
A Cross-Site Scripting (XSS) vulnerability exists in the `ui.interactive_image` component of NiceGUI (v3.3.1 and earlier). The component renders SVG content using Vue's `v-html` directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG `` tag.
### Details
The vulnerability is located in `nicegui/elements/interactive_image.js`.
The component uses the following code to render content:
```javascript
```
Vue's v-html directive renders raw HTML strings into the DOM. If an application allows user-controlled input to be passed to the content property of an interactive image, an attacker can embed a tag containing malicious scripts, bypassing typical im
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-12-09
Published