Listen to this Post
The vulnerability in NiceGUI versions 3.3.1 and below is a reflected Cross-Site Scripting (XSS) flaw in the ui.add_css, ui.add_scss, and `ui.add_sass` functions. These functions are designed to allow developers to dynamically add CSS or SCSS/SASS styles to a page. However, they fail to properly sanitize or encode user-controlled input before injecting it into the generated web page.
The core issue is that user input is placed directly inside
<code></script></code>.
This malicious input prematurely terminates the intended style or script block. Once the original context is closed, any content that follows is interpreted by the browser as regular HTML or JavaScript. This allows the attacker to inject and execute arbitrary JavaScript code in the context of the victim’s browser session.
The attack is “reflected” because the malicious payload is delivered via a single HTTP request, often through a URL parameter, and is immediately executed when the page is rendered. For example, an application that uses a URL parameter to dynamically set a theme color and passes that value directly to `ui.add_css()` would be vulnerable. When a victim visits a manipulated link, the attacker’s JavaScript executes, potentially allowing session hijacking, defacement, or other malicious actions.
Platform: NiceGUI Python framework
Version: Up to 3.3.1
Vulnerability: Reflected XSS injection
Severity: Medium (CVSS 6.1)
date: 2025-12-08
Prediction: Patch available 2025-12-08
What Undercode Say
Bash Commands
`pip list | grep nicegui` – Checks the installed version of NiceGUI.
`pip install –upgrade nicegui` – Upgrades the NiceGUI package to the latest, patched version.
Related Code Snippets
Vulnerable Code (Example): `ui.add_css(f'.q-btn {{ background-color: {color} !important; }}')` where `color` is unsanitized user input.
Exploit Payload: `red;}
How Exploit
An attacker crafts a URL containing a malicious XSS payload as a parameter.
The victim’s browser requests the NiceGUI application page with this malicious parameter.
The application takes the untrusted parameter value and passes it directly into a vulnerable function like ui.add_css().
The function injects the payload into the page inside a `
Protection from this CVE
Immediate Action: Upgrade NiceGUI to version 3.4.0 or later, where this vulnerability is fixed.
Code Review: Audit application code to ensure no untrusted data (e.g., URL parameters, user inputs) is passed directly to ui.add_css, ui.add_scss, or `ui.add_sass` functions.
Input Validation: Implement strict input validation and context-aware output encoding for any dynamic content that influences style.
Impact
Attackers can execute arbitrary JavaScript in the victim’s browser, leading to session hijacking, theft of authentication cookies, or redirection to malicious sites.
The vulnerability affects the confidentiality and integrity of user data but does not directly impact system availability.
Applications are at risk if they implement features like dynamic theming based on user-controlled input without proper safeguards.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow DailyCVE & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin
