6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66470

CVE-2025-66470: NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

Summary

A Cross-Site Scripting (XSS) vulnerability exists in the ui.interactive_image component of NiceGUI (v3.3.1 and earlier). The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG <foreignObject> tag.

Details

The vulnerability is located in nicegui/elements/interactive_image.js. The component uses the following code to render content:

<g v-html="content"></g>

Vue's v-html directive renders raw HTML strings into the DOM. If an application allows user-controlled input to be passed to the content property of an interactive image, an attacker can embed a <foreignObject> tag containing malicious scripts, bypassing typical image restrictions.

PoC

from nicegui import ui

@ui.page('/')
def main():
    ui.label('NiceGUI SVG XSS PoC')
    
    # Standard image loading
    img = ui.interactive_image('[https://picsum.photos/640/360](https://picsum.photos/640/360)')
    
    # Payload: Embeds raw HTML execution inside SVG
    # This executes immediately when the image component is rendered
    img.content = (
        '<foreignObject>'
        '<body xmlns="[http://www.w3.org/1999/xhtml](http://www.w3.org/1999/xhtml)">'
        '<img src=x onerror=alert("XSS-SVG")>'
        '</body>'
        '</foreignObject>'
    )

ui.run()

Impact

Type: Reflected / Stored XSS (depending on data source)
Severity: Moderate
Impact: Attackers can inject malicious scripts that execute whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66470

CVE-2025-66470:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nicegui	pip	<= 3.3.1	3.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the ui.interactive_image component of NiceGUI, where SVG content was rendered without sanitization, leading to a Cross-Site Scripting (XSS) issue. The root cause was the use of Vue's v-html directive in the frontend, which renders raw HTML. An attacker could provide a malicious SVG payload containing <foreignObject> with embedded scripts.

The analysis of the patch commit 58ad0b36e19922de16bbc79ea3ddd29851b1a3e3 reveals that the fix involves introducing a sanitize parameter to the InteractiveImage and InteractiveImageLayer components. The key vulnerable functions are the constructors (__init__) for these classes, as they are the primary entry points for the unsanitized content. Additionally, the add_layer method of InteractiveImage was vulnerable as it created new layers without ensuring their content would be sanitized.

The patch addresses the vulnerability by adding a _handle_content_change method that applies a sanitization function to the content before it is sent to the frontend. By default, if content is provided without an explicit sanitize option, a warning is issued. This change ensures that developers are aware of the potential security risk and must explicitly choose to disable sanitization if needed.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-66470: NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

Summary

Details

PoC

Impact

CVE-2025-66470:

6.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

6.1

6.1

CVE-2025-66470: NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

Summary

Details

PoC

Impact

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI