← Vulnerability feed

Vulnerability record · CVE-2025-66470 · published 9 December 2025

CVE-2025-66470: Zauberzeug nicegui cross-site scripting vulnerability

Zauberzeug · Nicegui

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG <foreignObject> tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0.

6.1 CVSS 3.1 Medium EPSS 0.25% · top 84.6% CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score
0.25%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG <foreignObject> tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/zauberzeug/nicegui/commit/58ad0b36e19922de16bbc79ea3ddd29851b1a3e3 Patch
https://github.com/zauberzeug/nicegui/security/advisories/GHSA-2m4f-cg75-76w2 ExploitVendor Advisory
https://github.com/zauberzeug/nicegui/security/advisories/GHSA-2m4f-cg75-76w2 ExploitVendor Advisory

Track CVE-2025-66470 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-39844Zauberzeug nicegui path traversal vulnerabilityNiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can …EPSS 0.49%7.5CVE-2026-25732Zauberzeug nicegui path traversal vulnerabilityNiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitiza…EPSS 3.3%7.5CVE-2025-66645Zauberzeug nicegui path traversal vulnerabilityNiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, wh…EPSS 1.1%6.9CVE-2026-33332Zauberzeug nicegui improper input validation vulnerabilityNiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-c…EPSS 0.69%6.1CVE-2026-27156Zauberzeug nicegui cross-site scripting vulnerabilityNiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements (`Element.run_metho…EPSS 0.27%6.1CVE-2026-25516Zauberzeug nicegui cross-site scripting vulnerabilityNiceGUI is a Python-based UI framework. The ui.markdown() component uses the markdown2 library to convert markdown content to HTML, which is then ren…EPSS 0.32%6.1CVE-2026-21872Zauberzeug nicegui cross-site scripting vulnerabilityNiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the click event listener used by ui.sub_pages, com…EPSS 0.27%6.1CVE-2026-21873Zauberzeug nicegui cross-site scripting vulnerabilityNiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages …EPSS 0.26%

Source: NIST National Vulnerability Database (record CVE-2025-66470), CISA KEV, FIRST EPSS (scores of 2026-10-05). This page is refreshed as NVD updates the record.