{"id":"CVE-2025-66470","title":"NiceGUI is a Python-based UI framework","summary":"NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitiz…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"zauberzeug","product":"nicegui","affected":["nicegui < 3.4.0"],"patched":["nicegui 3.4.0"],"published":"2025-12-09","updated":"2026-10-07","sourceUpdated":"2026-10-07T20:10:01.970","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66470","references":[{"url":"https://github.com/zauberzeug/nicegui/commit/58ad0b36e19922de16bbc79ea3ddd29851b1a3e3","label":"security-advisories@github.com"},{"url":"https://github.com/zauberzeug/nicegui/security/advisories/GHSA-2m4f-cg75-76w2","label":"security-advisories@github.com"},{"url":"https://github.com/zauberzeug/nicegui/security/advisories/GHSA-2m4f-cg75-76w2","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66470"},{"url":"https://github.com/zauberzeug/nicegui"}],"tags":["nvd","exploit-available","osv","pip"],"epss":0.00254,"epssPercentile":0.16852,"exploits":{"github":1,"githubRepos":["https://github.com/Jmehta10/CVE-2025-66470"],"checkedAt":"2026-10-27T16:49:11.633Z"},"exploitAvailable":true,"aliases":["GHSA-2m4f-cg75-76w2","PYSEC-2026-1696"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:44.559Z","slug":"CVE-2025-66470","body":"## Overview\n\nNiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG <foreignObject> tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0.\n\n## Affected\n\n- `nicegui < 3.4.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `nicegui 3.4.0`\n\n## Package advisory (CVE-2025-66470)\n\nAffected packages:\n\n- `nicegui < 3.4.0`\n\nPatched in:\n\n- `nicegui 3.4.0`\n\nSource: https://osv.dev/vulnerability/GHSA-2m4f-cg75-76w2","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4864,"id":"CVE-2025-66470","ts":1788887212304,"field":"exploit_available","old":"false","new":"true"},{"seq":3747,"id":"CVE-2025-66470","ts":1788886328934,"field":"exploit_available","old":"true","new":"false"},{"seq":2592,"id":"CVE-2025-66470","ts":1788883009983,"field":"exploit_available","old":"false","new":"true"},{"seq":1621,"id":"CVE-2025-66470","ts":1788882410301,"field":"exploit_available","old":"true","new":"false"},{"seq":732,"id":"CVE-2025-66470","ts":1788881847531,"field":"exploit_available","old":"false","new":"true"}]}