CVE-2025-66469
📋 TL;DR
NiceGUI versions 3.3.1 and below are vulnerable to Reflected Cross-Site Scripting (XSS) through the ui.add_css, ui.add_scss, and ui.add_sass functions. Attackers can inject malicious JavaScript by breaking out of style/script tags, potentially compromising user sessions or performing actions on behalf of users. This affects any application using these vulnerable NiceGUI functions.
💻 Affected Systems
- NiceGUI
📦 What is this software?
Nicegui by Zauberzeug
⚠️ Risk & Real-World Impact
Worst Case
Attackers execute arbitrary JavaScript in users' browsers, potentially stealing session cookies, performing actions as authenticated users, or redirecting to malicious sites.
Likely Case
Session hijacking, credential theft, or defacement of the application interface through injected malicious scripts.
If Mitigated
Limited impact with proper Content Security Policy (CSP) headers and input validation, though the vulnerability still exists.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) but is technically simple once the injection vector is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.0
Vendor Advisory: https://github.com/zauberzeug/nicegui/security/advisories/GHSA-72qc-wxch-74mg
Restart Required: Yes
Instructions:
1. Update NiceGUI to version 3.4.0 or higher using pip: pip install --upgrade nicegui==3.4.0
2. Restart your application to apply the fix.
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation for parameters passed to ui.add_css, ui.add_scss, and ui.add_sass functions.
Content Security Policy
allImplement strict CSP headers to prevent execution of injected scripts.
🧯 If You Can't Patch
- Disable or restrict usage of ui.add_css, ui.add_scss, and ui.add_sass functions with user input
- Implement web application firewall (WAF) rules to detect and block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check if your NiceGUI version is 3.3.1 or below and if you use ui.add_css, ui.add_scss, or ui.add_sass with user-controlled input.Check Version:
python -c "import nicegui; print(nicegui.__version__)"Verify Fix Applied:
Verify NiceGUI version is 3.4.0 or higher and test that user input to the affected functions no longer executes JavaScript.📡 Detection & Monitoring
Log Indicators:
- Unusual patterns in CSS/SCSS/SASS function calls
- Requests containing script or style closing tags in parameters
Network Indicators:
- HTTP requests with suspicious payloads in query parameters or POST data
SIEM Query:
source="web_logs" AND (uri_query="*</script>*" OR uri_query="*</style>*" OR post_data="*</script>*" OR post_data="*</style>*")