759 matches found
CVE-2025-66469
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.addcss, ui.addscss, and ui.addsass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended or...
CVE-2025-66469 NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.addcss, ui.addscss, and ui.addsass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended or...
CVE-2025-66469
CVE-2025-66469 is a reported Reflected XSS in NiceGUI (Python UI framework). The vulnerability affects versions 3.3.1 and earlier and stems from insufficient sanitization/escaping in the functions ui.add_css, ui.add_scss, and ui.add_sass, which generate JavaScript contexts that can be broken out ...
CVE-2025-66469 NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.addcss, ui.addscss, and ui.addsass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended or...
GHSA-72QC-WXCH-74MG NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
Summary A Cross-Site Scripting XSS vulnerability exists in ui.addcss, ui.addscss, and ui.addsass functions in NiceGUI v3.3.1 and earlier. These functions allow developers to inject styles dynamically. However, they lack proper sanitization or encoding for the JavaScript context they generate. An...
EUVD-2025-177553
Malicious code in nodejs-sass-loader-carina-duplex npm...
EUVD-2025-177567
Malicious code in node-sass-commitlint-lynx-public npm...
EUVD-2025-175436
Malicious code in yonder-sass-loader-firebase-cosmicsilence npm...
EUVD-2025-177708
Malicious code in native-blackhole-parcel-node-sass npm...
EUVD-2025-177369
Malicious code in paleoclimatology-node-sass-asteroid-pulsar npm...
EUVD-2025-177565
Malicious code in node-sass-ignite-dotenv-safe-neptunology npm...
Malicious code in remark-io-sass-loader-changelog (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ef20101ee38f63c38e24ae8f075da72835328afa3145f6b4e7eeca7e3e984ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in node-sass-slides-koa-hexo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3d901b770938de6417077db7f0e64048574068406c7bf11efcce84fe61d1993 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-180410
Malicious code in antd-node-sass-zenobia-eris npm...
EUVD-2025-177120
Malicious code in plutology-sass-loader-mongoose-extremophile npm...
EUVD-2025-178348
Malicious code in iota-betelgeuse-rest-sass-loader npm...
EUVD-2025-177718
Malicious code in mysql-quasar-nodejs-node-sass npm...
EUVD-2025-176741
Malicious code in regulus-node-sass-hugo-mensa npm...
Malicious code in node-sass-commitlint-lynx-public (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb7d81eb99a4b615630e9110e9e4e09cc3bdc9fe3ab07efd0d8b6117778b75e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...