Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-3hyc-h7ym-y7c9
Vulnerability ID VCID-3hyc-h7ym-y7c9
Aliases CVE-2025-66470
GHSA-2m4f-cg75-76w2
Summary NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content A Cross-Site Scripting (XSS) vulnerability exists in the `ui.interactive_image` component of NiceGUI (v3.3.1 and earlier). The component renders SVG content using Vue's `v-html` directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG `<foreignObject>` tag.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
There are no known severity scores.
Reference id Reference type URL
https://github.com/zauberzeug/nicegui
https://github.com/zauberzeug/nicegui/commit/58ad0b36e19922de16bbc79ea3ddd29851b1a3e3
CVE-2025-66470 https://nvd.nist.gov/vuln/detail/CVE-2025-66470
GHSA-2m4f-cg75-76w2 https://github.com/advisories/GHSA-2m4f-cg75-76w2
GHSA-2m4f-cg75-76w2 https://github.com/zauberzeug/nicegui/security/advisories/GHSA-2m4f-cg75-76w2
No exploits are available.
There are no known vectors.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-02T04:49:05.747477+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/nicegui/CVE-2025-66470.yml 38.6.0