{“lastseen”:””,”description”:”NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.add_css, ui.add_scss, and ui.add_sass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended \\u003cstyle\\u003e or \\u003cscript\\u003e tags by injecting closing tags (e.g., \\u003c\/style\\u003e or \\u003c\/script\\u003e), allowing for the execution of arbitrary JavaScript. This issue is fixed in version 3.4.0.”,”published”:”2025-12-08T23:54:37.955Z”,”modified”:”2025-12-08T23:54:37.955Z”,”type”:”cve”,”title”:”NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection”,”source”:”GitHub_M”,”references”:”https:\/\/github.com\/zauberzeug\/nicegui\/security\/advisories\/GHSA-72qc-wxch-74mg\\nhttps:\/\/github.com\/zauberzeug\/nicegui\/commit\/a8fd25b7d5e23afb1952d0f60a1940e18b5f1ca8″,”id”:”CVE-2025-66469″,”bulletinFamily”:””,”cwe”:[“CWE-79″],”cvelist”:null,”sourceData”:”zauberzeug nicegui \\u003c 3.4.0″,”sourceHref”:””,”cvss”:{“score”:6.1,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”nicegui”,”version”:”\\u003c 3.4.0″,”vendor”:”zauberzeug”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.add_css, ui.add_scss, and ui.add_sass functions. The functions lack…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,31,12,21,13,7,11,5],"class_list":["post-29477","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-61","tag-exploit","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n