CVE-2025-66470Medium· 6.1▾ TwilightPoC availableNiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitiz…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 33.6 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.3%
1 GitHub repo
Last analysed / modified upstream
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG <foreignObject> tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0.
nicegui < 3.4.0Upgrade past the affected range:
nicegui 3.4.0Affected packages:
nicegui < 3.4.0Patched in:
nicegui 3.4.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-53354Medium· 6.1NiceGUI is a Python-based UI framework
CVE-2025-66645High· 7.5NiceGUI is a Python-based UI framework
CVE-2026-39844Medium· 5.9NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
CVE-2026-33332Medium· 5.3NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
CVE-2026-25516Medium· 6.1NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
CVE-2026-45554Medium· 5.3NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes