VULNERABILITY INTELLIGENCE

CVE-2025-66469

CVSS score6.1 MEDIUM
EPSS probability0.27%
CISA KEVNot currently listed
Published2025-12-09
Last modified2026-10-19
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.add_css, ui.add_scss, and ui.add_sass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended <style> or <script> tags by injecting closing tags (e.g., </style> or </script>), allowing for the execution of arbitrary JavaScript. This issue is fixed in version 3.4.0.

Weakness classification

  • security-advisories@github.com: CWE-79

Primary references