CVE-2025-66470: Zauberzeug Nicegui

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG <foreignObject> tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0.

Affected products

• Zauberzeug Nicegui: before 3.4.0 (fixed in 3.4.0)

Published 2025-12-09. Last modified 2026-10-07.