https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T16:58:05.562862+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-66469 CVE-2025-66469 — NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection 2026-10-07T16:58:05.582777+00:00

Affected: zauberzeug nicegui

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.add_css, ui.add_scss, and ui.add_sass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended <style> or <script> tags by injecting closing tags (e.g., </style> or </script>), allowing for the execution of arbitrary JavaScript. This issue is fixed in version 3.4.0.