-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nicegui | pip | >= 2.22.0, <= 3.4.1 | 3.5.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the nicegui library, specifically within the ui.sub_pages functionality. The advisory points to the _handle_navigate function in nicegui/sub_pages_router.py as the source of the vulnerability. By analyzing the patch that fixes the issue, it's clear that the vulnerability lies in how JavaScript code is generated. The original code used a Python f-string to directly inject a path into a JavaScript snippet. This path could be manipulated by an attacker to include malicious JavaScript. The patch fixes this by using json.dumps to properly escape the path, preventing the XSS attack. Therefore, the SubPagesRouter._handle_navigate function is the vulnerable function that would appear in a runtime profile during exploitation.
SubPagesRouter._handle_navigatenicegui/sub_pages_router.py
A Semantic Attack on Google Gemini - Read the Latest Research