CVE-2025-66470: falha de média gravidade em zauberzeug nicegui
NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.3%
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG <foreignObject> tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
zauberzeug · niceguiCVEs relacionadas — zauberzeug nicegui
No mesmo produto, das mais perigosas para as menos.
CVE-2026-25732HIGHNiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File WriteEPSS 3.4%CVE-2025-66645HIGHNiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File ReadingEPSS 1.2%CVE-2024-32005HIGHLocal File Inclusion in NiceGUI leaflet componentEPSS 0.8%CVE-2026-33332MEDIUMNiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustionEPSS 0.6%CVE-2026-21874MEDIUMNiceGUI has Redis connection leak via tab storage causes service degradationEPSS 0.6%CVE-2025-21618HIGHNiceGUI On Air authentication issueEPSS 0.4%