Listen to this Post
The vulnerability CVE-2025-66470 is a Cross-Site Scripting (XSS) flaw in the NiceGUI Python framework, affecting versions 3.3.1 and earlier. It resides in the `ui.interactive_image` component, which is used to render SVG content. The core issue is that this component uses Vue.js’s `v-html` directive to directly inject user-supplied SVG strings into the Document Object Model (DOM) without any sanitization. Specifically, the vulnerable frontend code in `interactive_image.js` contains the line <g v-html="content"></g>.
This insecure practice allows an attacker to embed malicious HTML or JavaScript within an SVG payload by using the `
For example, a proof-of-concept payload can set the image’s content to: <foreignObject><body xmlns="http://www.w3.org/1999/xhtml"><img src=x onerror=alert("XSS-SVG")></body></foreignObject>. This script executes immediately when the component is rendered or its content is updated. The vulnerability can manifest as either a Reflected or Stored XSS attack, depending on whether the malicious payload is directly reflected from a request or stored in the application’s backend. This makes it particularly dangerous for dashboards or multi-user applications that display user-generated image annotations. The issue has been fixed in NiceGUI version 3.4.0.
Platform: NiceGUI (Python)
Version: <= 3.3.1
Vulnerability: SVG XSS
Severity: Medium
Date: 2025-12-08
Prediction: 2025-12-08
What Undercode Say:
Check installed package version: `pip show nicegui`
Upgrade to patched version: `pip install –upgrade nicegui==3.4.0`
The patch commit `58ad0b3` introduced a `sanitize` parameter and a `_handle_content_change` method to sanitize SVG content before frontend rendering.
Vulnerable functions included `InteractiveImage.__init__`, `InteractiveImageLayer.__init__`, and `InteractiveImage.add_layer`.
How Exploit:
Attackers inject scripts via the SVG `` element.
Payloads execute when the vulnerable `ui.interactive_image` component is rendered.
Exploit can be stored in app databases for persistent attacks.
Protection from this CVE:
Immediate upgrade to NiceGUI 3.4.0.
Manually sanitize all user input for SVG/HTML content if downgrade is necessary.
Review code for use of `ui.interactive_image` with external data sources.
Impact:
Allows execution of arbitrary JavaScript in victim’s browser.
Can lead to session hijacking, data theft, or actions performed on behalf of the user.
High risk for applications displaying user-generated content.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
