CVE-2025-66470
📋 TL;DR
NiceGUI versions 3.3.1 and below contain a cross-site scripting (XSS) vulnerability in the ui.interactive_image component. Attackers can inject malicious JavaScript via SVG foreignObject tags when rendering user-generated content, potentially compromising user sessions. This affects any application using NiceGUI for dashboards or multi-user interfaces with untrusted content.
💻 Affected Systems
- NiceGUI
📦 What is this software?
Nicegui by Zauberzeug
⚠️ Risk & Real-World Impact
Worst Case
Full account takeover, data theft, or malware distribution to all users viewing malicious content, potentially leading to complete system compromise if admin accounts are affected.
Likely Case
Session hijacking, credential theft, or unauthorized actions performed in the context of logged-in users viewing attacker-controlled content.
If Mitigated
Limited impact with proper input validation and output encoding, potentially only affecting users who directly interact with malicious content.
🎯 Exploit Status
Exploitation requires the attacker to supply malicious SVG content that gets rendered via the vulnerable component. Public advisory includes technical details sufficient for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.0
Vendor Advisory: https://github.com/zauberzeug/nicegui/security/advisories/GHSA-2m4f-cg75-76w2
Restart Required: Yes
Instructions:
1. Update NiceGUI to version 3.4.0 or higher using pip: pip install --upgrade nicegui>=3.4.0
2. Restart all NiceGUI applications
3. Verify the update was successful
🔧 Temporary Workarounds
Input Validation for SVG Content
allImplement strict input validation to reject or sanitize SVG content containing foreignObject tags before passing to ui.interactive_image
Disable Interactive Image Component
allRemove or disable usage of ui.interactive_image component if not essential
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Isolate NiceGUI applications behind reverse proxies with additional XSS filtering
🔍 How to Verify
Check if Vulnerable:
Check if NiceGUI version is 3.3.1 or below and application uses ui.interactive_image with untrusted SVG contentCheck Version:
python -c "import nicegui; print(nicegui.__version__)"Verify Fix Applied:
Verify NiceGUI version is 3.4.0 or higher and test that SVG foreignObject tags no longer execute JavaScript📡 Detection & Monitoring
Log Indicators:
- Unusual SVG content with foreignObject tags in user inputs
- Multiple failed attempts to inject script tags
Network Indicators:
- Unexpected JavaScript execution from SVG content
- Suspicious content-type headers for SVG responses
SIEM Query:
source="web_logs" AND (svg_content CONTAINS "foreignObject" OR svg_content CONTAINS "<script>")