-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nicegui | pip | <= 3.3.1 | 3.4.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the nicegui library's functions for adding dynamic styles: add_css, add_scss, and add_sass. The core issue is the lack of proper sanitization for user-controlled input before it is embedded into the HTML page.
add_css: The original code wrapped the input content directly within <style> tags. This allowed an attacker to craft an input string that closes the <style> tag and then injects a <script> tag, resulting in XSS. The patch mitigates this by no longer embedding the content directly. Instead, it passes the content to a new JavaScript helper function, addStyle, which programmatically creates a style element and sets its textContent. This ensures the browser treats the content as plain text, not as HTML to be parsed.
add_scss / add_sass: These functions compile SASS on the client side within a <script> tag. The vulnerability was similar: an input containing </script> could prematurely terminate the script block, allowing for arbitrary code injection. The fix involves sanitizing the input by escaping the < character (.replace('<', r'\\u003c')) before embedding it into the JavaScript string that gets compiled, preventing the browser from interpreting any injected tags.
add_cssnicegui/functions/style.py
add_scssnicegui/functions/style.py