Listen to this Post
This vulnerability is a DOM-based Cross-Site Scripting (XSS) in NiceGUI’s `ui.sub_pages` component. It stems from unsafe JavaScript execution when handling user-controlled navigation paths. The exploit chain begins when a user clicks a malicious link rendered on a page (e.g., via ui.markdown). This click triggers the `sub_pages_navigate` event in the frontend code (sub_pages.js). The `SubPagesRouter` in the backend (sub_pages_router.py) listens for this event and calls its `_handle_navigate` method. This method uses an f-string to inject the user-controlled `self.current_path` variable directly into a `run_javascript` call, surrounding it with double quotes: "{self.current_path}". An attacker can craft a link with a path containing a double quote followed by JavaScript payload (e.g., /"}+alert(1)+"). This payload breaks out of the string literal context in the generated JavaScript code, leading to arbitrary script execution in the victim’s browser when they click the link. The attack requires a deliberate user click, as the malicious code is not executed automatically upon page load.
Platform: NiceGUI
Version: Commit 59fa9424c4
Vulnerability: DOM XSS
Severity: Medium
date: 2025-12-28
Prediction: 2026-01-20
What Undercode Say:
Check if a site uses NiceGUI (often reveals version in source) curl -s http://target/ | grep -i "nicegui|__ng_version" Example vulnerable code pattern in application grep -r "ui.sub_pages|ui.markdown" ./app/
Proof-of-Concept exploit code
from nicegui import ui
ui.sub_pages({'/': lambda: ui.link('Go to XSS', '/"+alert(document.domain)+"')})
ui.run()
<!-- Malicious user input for a markdown field -->
<a href="/"+alert('XSS')+"">XSS LINK</a>
How Exploit:
- Attacker posts or injects a malicious markdown link into a user-controlled field rendered by
ui.markdown. - The link’s path contains a crafted payload to break JavaScript string syntax (e.g.,
/"+alert(1)+"). - A victim views the page and clicks the malicious link.
- The click event sends the tainted path to the backend’s `_handle_navigate` method.
- The method unsafely inserts the path into a JavaScript string, executing the attacker’s payload in the victim’s browser session.
Protection from this CVE:
Immediately update NiceGUI to a patched version once released.
Implement strict input validation for all user-generated links and paths.
Apply proper output encoding for dynamic content inserted into JavaScript contexts.
Deploy a Content Security Policy (CSP) to mitigate the impact of potential XSS.
Impact:
Execution of arbitrary JavaScript in the victim’s browser context.
Potential session hijacking or account takeover.
Website defacement or action forgery.
Theft of sensitive user data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
