CVE-2025-66470

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG <foreignObject> tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0.

• CWE-79

• https://github.com/zauberzeug/nicegui/commit/58ad0b36e19922de16bbc79ea3ddd29851b1a3e3Patch
• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-2m4f-cg75-76w2Exploit, Vendor Advisory
• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-2m4f-cg75-76w2Exploit, Vendor Advisory

Published

Dec 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66460Lookyloo is a web interface that allows users to capture a w…6.1
• CVE-2025-66461FULLBACK Manager Pro provided by GS Yuasa International Ltd.…8.4
• CVE-2025-66467Missing MinIO policy cleanup on bucket deletion via Apache C…8.1
• CVE-2025-66468The Aimeos GrapesJS CMS extension provides page editor for c…6.1
• CVE-2025-66469NiceGUI is a Python-based UI framework. Versions 3.3.1 and b…6.1
• CVE-2025-6647PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remo…7.8
• CVE-2025-66471urllib3 is a user-friendly HTTP client library for Python. S…7.5
• CVE-2025-66472XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2025-66473XWiki is an open-source wiki software platform. Versions 16.…7.5
• CVE-2025-66474XWiki Rendering is a generic rendering system that converts …8.8
• CVE-2025-66476Vim is an open source, command line text editor. Prior to ve…7.8
• CVE-2025-66478Rejected reason: This CVE is a duplicate of CVE-2025-55182.