otanalytics (>=0.6.15, <=0.7.5), synth-mapping-helper (1.5.19) potentially affected by CVE-2025-66470 via nicegui (2.24.1)

nicegui PYPI version 2.24.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - otanalytics =0.6.15, =0.7.5 - synth-mapping-helper 1.5.19 Source cves: CVE-2025-66470 Source advisory: OSV:GHSA-2M4F-CG75-76W2...

ai-plays-jackbox (>=0.0.1, <=0.3.2), air-link (>=0.3.0, <=0.5.0) +23 more potentially affected by CVE-2025-66470 via nicegui (2.24.2)

nicegui PYPI version 2.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - ai-plays-jackbox =0.0.1, =0.3.0, =0.8.0, =1.11.0b1, =0.13.24, =0.2.14, =0.30.0, =2.0.0, =0.2.0, =0.2.0, =0.0.1, =0.0.4 and more Source cves:...

aignostics (>=0.2.200, <=0.2.226), bindmc (>=0.1.3, <=0.1.11) +3 more potentially affected by CVE-2025-66470 via nicegui (>=3.0.0rc1, <=3.3.1)

nicegui PYPI version =3.0.0rc1, =0.2.200, =0.1.3, =0.4.24, =0.4.25 Source cves: CVE-2025-66470 Source advisory: OSV:GHSA-2M4F-CG75-76W2...

GHSA-2M4F-CG75-76W2 NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

Summary A Cross-Site Scripting XSS vulnerability exists in the ui.interactiveimage component of NiceGUI v3.3.1 and earlier. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG tag. Detail...

rosys (0.4.9) potentially affected by CVE-2025-66470 via nicegui (0.6.9)

nicegui PYPI version 0.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.4.9 Source cves: CVE-2025-66470 Source advisory: OSV:GHSA-2M4F-CG75-76W2...

rosys (>=0.3.3, <=0.4.5) potentially affected by CVE-2025-66470 via nicegui (0.6.5)

nicegui PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.3.3, =0.4.5 Source cves: CVE-2025-66470 Source advisory: OSV:GHSA-2M4F-CG75-76W2...

rosys (>=0.4.10, <=0.4.12) potentially affected by CVE-2025-66470 via nicegui (0.6.10)

nicegui PYPI version 0.6.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.4.10, =0.4.12 Source cves: CVE-2025-66470 Source advisory: OSV:GHSA-2M4F-CG75-76W2...

rosys (>=0.5.1, <=0.5.2) potentially affected by CVE-2025-66470 via nicegui (0.7.2)

nicegui PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.1, =0.5.2 Source cves: CVE-2025-66470 Source advisory: OSV:GHSA-2M4F-CG75-76W2...

rosys (>=0.5.3, <=0.5.10) potentially affected by CVE-2025-66470 via nicegui (0.7.6)

nicegui PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.3, =0.5.10 Source cves: CVE-2025-66470 Source advisory: OSV:GHSA-2M4F-CG75-76W2...

rosys (0.5.13) potentially affected by CVE-2025-66470 via nicegui (0.7.15)

nicegui PYPI version 0.7.15 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.5.13 Source cves: CVE-2025-66470 Source advisory: OSV:GHSA-2M4F-CG75-76W2...

rosys (>=0.3.0, <=0.3.1) potentially affected by CVE-2025-66470 via nicegui (0.5.9)

nicegui PYPI version 0.5.9 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.3.0, =0.3.1 Source cves: CVE-2025-66470 Source advisory: OSV:GHSA-2M4F-CG75-76W2...

rosys (>=0.4.13, <=0.5.0) potentially affected by CVE-2025-66470 via nicegui (0.6.12)

nicegui PYPI version 0.6.12 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.4.13, =0.5.0 Source cves: CVE-2025-66470 Source advisory: OSV:GHSA-2M4F-CG75-76W2...

rosys (>=0.5.11, <=0.5.12) potentially affected by CVE-2025-66470 via nicegui (0.7.10)

nicegui PYPI version 0.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.11, =0.5.12 Source cves: CVE-2025-66470 Source advisory: OSV:GHSA-2M4F-CG75-76W2...

rosys (>=0.5.14, <=0.5.17) potentially affected by CVE-2025-66470 via nicegui (0.7.21)

nicegui PYPI version 0.7.21 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.14, =0.5.17 Source cves: CVE-2025-66470 Source advisory: OSV:GHSA-2M4F-CG75-76W2...

openadapt (>=0.8.0, <=0.8.1) potentially affected by CVE-2025-66470 via nicegui (1.2.24)

nicegui PYPI version 1.2.24 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - openadapt =0.8.0, =0.8.1 Source cves: CVE-2025-66470 Source advisory: OSV:GHSA-2M4F-CG75-76W2...

nice-gui-utils (>=0.1.2.dev0, <=0.1.2.dev3) potentially affected by CVE-2025-66470 via nicegui (1.4.1)

nicegui PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - nice-gui-utils =0.1.2.dev0, =0.1.2.dev3 Source cves: CVE-2025-66470 Source advisory: OSV:GHSA-2M4F-CG75-76W2...

nice-gui-utils (>=0.1.2, <=0.1.5) potentially affected by CVE-2025-66470 via nicegui (1.4.2)

nicegui PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - nice-gui-utils =0.1.2, =0.1.5 Source cves: CVE-2025-66470 Source advisory: OSV:GHSA-2M4F-CG75-76W2...

NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection

Summary A Cross-Site Scripting XSS vulnerability exists in ui.addcss, ui.addscss, and ui.addsass functions in NiceGUI v3.3.1 and earlier. These functions allow developers to inject styles dynamically. However, they lack proper sanitization or encoding for the JavaScript context they generate. An...

rosys (>=0.8.4, <=0.8.5) potentially affected by CVE-2025-66469 via nicegui (1.2.17)

nicegui PYPI version 1.2.17 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.8.4, =0.8.5 Source cves: CVE-2025-66469 Source advisory: OSV:GHSA-72QC-WXCH-74MG...

openadapt (>=0.8.0, <=0.8.1) potentially affected by CVE-2025-66469 via nicegui (1.2.24)

nicegui PYPI version 1.2.24 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - openadapt =0.8.0, =0.8.1 Source cves: CVE-2025-66469 Source advisory: OSV:GHSA-72QC-WXCH-74MG...