Listen to this Post
How the CVE Works
The vulnerability exists within the `ui.interactive_image` component of the NiceGUI framework. The component’s frontend JavaScript (interactive_image.js) uses Vue.js’s `v-html` directive to directly inject user-supplied data into the Document Object Model (DOM) as raw HTML. This data is intended to be SVG markup. However, `v-html` does not perform any sanitization. An attacker can exploit this by providing SVG content containing a `<foreignObject>—such as an `` tag with an `onerror` handler—the script executes automatically when the SVG is rendered by the victim’s browser. This bypasses any image-based content restrictions, leading to arbitrary JavaScript execution in the context of the NiceGUI application.
DailyCVE Form:
Platform: NiceGUI
Version: <= v3.3.1
Vulnerability : SVG XSS
Severity: Moderate
Date: Unspecified
Prediction: Q4 2024 Patch
What Undercode Say:
Locate the vulnerable component file find . -name "interactive_image.js" -type f
// Code from nicegui/elements/interactive_image.js // The 'content' property is rendered unsafely. template: `<svg ... v-html="content"></svg>`
Proof-of-Concept exploit code
from nicegui import ui
img = ui.interactive_image('...')
img.content = '<foreignObject><body xmlns="http://www.w3.org/1999/xhtml"><img src=x onerror=alert("XSS")></body></foreignObject>'
ui.run()
How Exploit:
1. Attacker controls `interactive_image.content` property.
2. Payload uses SVG ``.
3. Embeds HTML with script trigger (`onerror`).
4. Victim views page, payload executes.
Protection from this CVE:
Sanitize SVG input.
Avoid `v-html` for user data.
Use Vue’s built-in sanitization.
Update NiceGUI post-patch.
Impact:
Arbitrary script execution.
Session hijacking.
Dashboard compromise.
Data theft.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
