NiceGUI 安全漏洞

NiceGUI is an easy-to-use, Python-based UI framework open-sourced by NiceGUI. A security vulnerability exists in NiceGUI 3.3.1 and earlier versions, which stems from the ui.activeimage component not cleaning up SVG content, and could lead to cross-site scripting attacks...

CVE-2025-66645: Improper Limitation of a Pathname to a Restricted Directory

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.addmediafiles function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version 3.4.0...

CVE-2025-66470: Improper Neutralization of Input During Web Page Generation

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactiveimage component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or...

NiceGUI 路径遍历漏洞

NiceGUI is an easy-to-use, Python-based UI framework open-sourced by NiceGUI. A path traversal vulnerability exists in NiceGUI 3.3.1 and earlier versions, which stems from a flaw in the App.addmediafiles function that could lead to a directory traversal attack...

PT-2025-50275

Name of the Vulnerable Software and Affected Versions NiceGUI versions 3.3.1 and below Description NiceGUI, a Python-based UI framework, contains a flaw that allows a remote attacker to read arbitrary files on the server filesystem. This is due to a directory traversal issue present in the App.ad...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +51 more potentially affected by CVE-2025-66469 via nicegui (>=0.5.9, <=3.3.1)

nicegui PYPI version =0.5.9, =0.0.1, =0.2.200, =0.0.0, =0.1.3, =0.1.0, =1.1.3, =0.6.7, =1.0.0, =1.2.0, =0.10.0, =0.11.1 and more Source cves: CVE-2025-66469 Source advisory: MEND:CVE-2025-66469...

CVE-2025-66469 NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.addcss, ui.addscss, and ui.addsass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended or...

CVE-2025-66469 NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.addcss, ui.addscss, and ui.addsass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended or...

CVE-2025-66469

CVE-2025-66469 is a reported Reflected XSS in NiceGUI (Python UI framework). The vulnerability affects versions 3.3.1 and earlier and stems from insufficient sanitization/escaping in the functions ui.add_css, ui.add_scss, and ui.add_sass, which generate JavaScript contexts that can be broken out ...

EUVD-2025-201814

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.addcss, ui.addscss, and ui.addsass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended or...

CVE-2025-66469 NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.addcss, ui.addscss, and ui.addsass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended or...

GHSA-2M4F-CG75-76W2 NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

Summary A Cross-Site Scripting XSS vulnerability exists in the ui.interactiveimage component of NiceGUI v3.3.1 and earlier. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG tag. Detail...

Cross-site Scripting (XSS)

Overview nicegui is a Create web-based user interfaces with Python. The nice way. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ui.interactiveimage component when rendering SVG content using the v-html directive without sanitization. An attacker can execute...

NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

Summary A Cross-Site Scripting XSS vulnerability exists in the ui.interactiveimage component of NiceGUI v3.3.1 and earlier. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG tag. Detail...

rosys (>=0.3.0, <=0.3.1) potentially affected by CVE-2025-66469 via nicegui (0.5.9)

nicegui PYPI version 0.5.9 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.3.0, =0.3.1 Source cves: CVE-2025-66469 Source advisory: OSV:GHSA-72QC-WXCH-74MG...

synth-mapping-helper (>=1.4.8, <=1.5.0) potentially affected by CVE-2025-66469 via nicegui (1.4.36)

nicegui PYPI version 1.4.36 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.4.8, =1.5.0 Source cves: CVE-2025-66469 Source advisory: OSV:GHSA-72QC-WXCH-74MG...

rosys (>=0.5.18, <=0.5.21) potentially affected by CVE-2025-66469 via nicegui (0.7.27)

nicegui PYPI version 0.7.27 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.18, =0.5.21 Source cves: CVE-2025-66469 Source advisory: OSV:GHSA-72QC-WXCH-74MG...

rosys (>=0.8.4, <=0.8.5) potentially affected by CVE-2025-66469 via nicegui (1.2.17)

nicegui PYPI version 1.2.17 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.8.4, =0.8.5 Source cves: CVE-2025-66469 Source advisory: OSV:GHSA-72QC-WXCH-74MG...

rosys (0.8.3) potentially affected by CVE-2025-66469 via nicegui (1.2.10)

nicegui PYPI version 1.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.8.3 Source cves: CVE-2025-66469 Source advisory: OSV:GHSA-72QC-WXCH-74MG...

rosys (>=0.4.13, <=0.5.0) potentially affected by CVE-2025-66469 via nicegui (0.6.12)

nicegui PYPI version 0.6.12 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.4.13, =0.5.0 Source cves: CVE-2025-66469 Source advisory: OSV:GHSA-72QC-WXCH-74MG...