https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:44:38 +0000 https://cve.radiocsirt.org/vuln/cve-2025-66470 <p><strong>Affected:</strong> zauberzeug nicegui</p> <p>NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue&#39;s v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG &lt;foreignObject&gt; tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0.</p> <p><strong>Affected:</strong> zauberzeug nicegui</p> <p>NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue&#39;s v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG &lt;foreignObject&gt; tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0.</p> https://cve.radiocsirt.org/vuln/cve-2025-66470 https://cve.radiocsirt.org/vuln/pysec-2026-1696 <p><strong>Affected:</strong> PyPI: nicegui</p> <p>### Summary A Cross-Site Scripting (XSS) vulnerability exists in the `ui.interactive_image` component of NiceGUI (v3.3.1 and earlier). The component renders SVG content using Vue&#39;s `v-html` directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG `&lt;foreignObject&gt;` tag.</p> <p>### Details The vulnerability is located in `nicegui/elements/interactive_image.js`. The component uses the following code to render content: ```javascript &lt;g v-html=&#34;content&#34;&gt;&lt;/g&gt; ``` Vue&#39;s v-html directive renders raw HTML strings into the DOM. If an application allows user-controlled input to be passed to the content property of an interactive image, an attacker can embed a &lt;foreignObject&gt; tag containing malicious scripts, bypassing typical image restrictions.</p> <p>### PoC ```python from nicegui import ui</p> <p>@ui.page(&#39;/&#39;) def main(): ui.label(&#39;NiceGUI SVG XSS PoC&#39;) # Standard image loading img = ui.interactive_image(&#39;[https://picsum.photos/640/360](https://picsum.photos/640/360)&#39;) # Payload: Embeds raw HTML execution inside SVG # This executes immediately when the image component is rendered img.content = ( &#39;&lt;foreignObject&gt;&#39; &#39;&lt;body xmlns=&#34;[http://www.w3.org/1999/xhtml](http://www.w3.org/1999/xhtml)&#34;&gt;&#39; &#39;&lt;img src=x onerror=alert(&#34;XSS-SVG&#34;)&gt;&#39; &#39;&lt;/body&gt;&#39; &#39;&lt;/foreignObject&gt;&#39; )</p> <p>ui.run() ```</p> <p>### Impact - Type: Reflected / Stored XSS (depending on data source)</p> <p>- Severity: Moderate</p> <p>- Impact:…</p> <p><strong>Affected:</strong> PyPI: nicegui</p> <p>### Summary A Cross-Site Scripting (XSS) vulnerability exists in the `ui.interactive_image` component of NiceGUI (v3.3.1 and earlier). The component renders SVG content using Vue&#39;s `v-html` directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG `&lt;foreignObject&gt;` tag.</p> <p>### Details The vulnerability is located in `nicegui/elements/interactive_image.js`. The component uses the following code to render content: ```javascript &lt;g v-html=&#34;content&#34;&gt;&lt;/g&gt; ``` Vue&#39;s v-html directive renders raw HTML strings into the DOM. If an application allows user-controlled input to be passed to the content property of an interactive image, an attacker can embed a &lt;foreignObject&gt; tag containing malicious scripts, bypassing typical image restrictions.</p> <p>### PoC ```python from nicegui import ui</p> <p>@ui.page(&#39;/&#39;) def main(): ui.label(&#39;NiceGUI SVG XSS PoC&#39;) # Standard image loading img = ui.interactive_image(&#39;[https://picsum.photos/640/360](https://picsum.photos/640/360)&#39;) # Payload: Embeds raw HTML execution inside SVG # This executes immediately when the image component is rendered img.content = ( &#39;&lt;foreignObject&gt;&#39; &#39;&lt;body xmlns=&#34;[http://www.w3.org/1999/xhtml](http://www.w3.org/1999/xhtml)&#34;&gt;&#39; &#39;&lt;img src=x onerror=alert(&#34;XSS-SVG&#34;)&gt;&#39; &#39;&lt;/body&gt;&#39; &#39;&lt;/foreignObject&gt;&#39; )</p> <p>ui.run() ```</p> <p>### Impact - Type: Reflected / Stored XSS (depending on data source)</p> <p>- Severity: Moderate</p> <p>- Impact:…</p> https://cve.radiocsirt.org/vuln/pysec-2026-1696