Medium
NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
Type: advisorySources: OSV
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.add_css, ui.add_scss, and ui.add_sass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended or ), allowing for the execution of arbitrary JavaScript. This issue is fixed in version 3.4.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-66469
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 01:26 UTC · Revision 1
Source evidence
NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
core-osv · Original sourcePublished 8 Dec 2025, 23:54 UTC
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.add_css, ui.add_scss, and ui.add_sass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended or ), allowing for the execution of arbitrary JavaScript. This issue is fixed in version 3.4.0.
osv:CVE-2025-66469
Complete source record
{
"id": "3c8a025d617ce1a8feefd74c1b796582a4d34b05b3490f4b4ea93f0682a354e7",
"url": "https://osv.dev/vulnerability/CVE-2025-66469",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection",
"summary": "NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.add_css, ui.add_scss, and ui.add_sass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended or ), allowing for the execution of arbitrary JavaScript. This issue is fixed in version 3.4.0.",
"evidence": "osv:CVE-2025-66469",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-66469",
"aliases": [
"CVE-2025-66469",
"GHSA-72qc-wxch-74mg",
"PYSEC-2026-1697"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/zauberzeug/nicegui",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "6502fb37bc1cb39752f4e75c12b608078939cc73"
},
{
"fixed": "a8fd25b7d5e23afb1952d0f60a1940e18b5f1ca8"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:zauberzeug:nicegui:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.4.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "a8fd25b7d5e23afb1952d0f60a1940e18b5f1ca8"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v3.3.1",
"v3.3.0",
"v3.2.0",
"v3.1.0",
"v3.0.4",
"v3.0.3",
"v3.0.2",
"v3.0.1",
"v3.0.0",
"v2.24.2",
"v2.24.1",
"v2.24.0",
"v2.23.3",
"v2.23.2",
"v2.23.1",
"v2.23.0",
"v2.22.1",
"v2.22.0",
"v2.21.0",
"v2.20.0",
"v2.19.0",
"v2.18.0",
"v2.17.0",
"v2.16.1",
"v2.16.0",
"v2.15.0",
"v2.14.1",
"v2.14.0",
"v2.13.0",
"v2.12.1",
"v2.12.0",
"v2.11.1",
"v2.11.0",
"v2.10.1",
"v2.10.0",
"v2.9.1",
"v2.9.0",
"v2.8.1",
"v2.8.0",
"v2.7.0",
"v2.5.0",
"v2.4.0",
"v2.3.0",
"v2.2.0",
"v2.1.0",
"v2.0.1",
"v2.0.0",
"v1.4.37",
"v1.4.36",
"v1.4.35",
"v1.4.34",
"v1.4.33",
"v1.4.32",
"v1.4.31",
"v1.4.30",
"v1.4.29",
"v1.4.28",
"v1.4.27",
"v1.4.26",
"v1.4.25",
"v1.4.24",
"v1.4.23",
"v1.4.22",
"v1.4.21",
"v1.4.20",
"v1.4.19",
"v1.4.18",
"v1.4.17",
"v1.4.16",
"v1.4.15",
"v1.4.14",
"v1.4.13",
"v1.4.12",
"v1.4.11",
"v1.4.10",
"v1.4.9",
"v1.4.8",
"v1.4.7",
"v1.4.6",
"v1.4.5",
"v1.4.4",
"v1.4.3",
"v1.4.2",
"v1.4.1",
"v1.4.0",
"v1.3.16",
"v1.3.15",
"v1.3.14",
"v1.3.13",
"v1.3.12",
"v1.3.11",
"v1.3.10",
"v1.3.9",
"v1.3.8",
"v1.3.7",
"v1.3.6",
"v1.3.5",
"v1.3.4",
"v1.3.2",
"v1.3.1",
"v1.3.0",
"v1.2.6",
"v1.2.5",
"v1.2.4",
"v1.2.3",
"v1.2.2",
"v1.1.11",
"v1.1.10",
"v1.1.9",
"v1.1.8",
"v1.1.7",
"v1.1.6",
"v1.1.5",
"v1.1.4",
"v1.1.3",
"v1.1.2",
"v1.1.1",
"v1.1.0",
"v1.0.10",
"v1.0.9",
"v0.9.26",
"v1.0.8",
"v1.0.7",
"v1.0.6",
"v1.0.5",
"v1.0.4",
"v1.0.3",
"v1.0.2",
"v1.0.1",
"v1.0.0",
"v0.9.25",
"v0.9.24",
"v0.9.22",
"v0.9.21",
"v0.9.20",
"v0.9.19",
"v0.9.18",
"v0.9.17",
"v0.9.16",
"v0.9.15",
"v0.9.14",
"v0.9.13",
"v0.9.12",
"v0.9.11",
"v0.9.10",
"v0.9.9",
"v0.9.8",
"v0.9.7",
"v0.9.6",
"v0.9.5",
"v0.9.4",
"v0.9.3",
"v0.9.2",
"v0.9.1",
"v0.9.0",
"v0.8.16",
"v0.8.15",
"v0.8.14",
"v0.8.13",
"v0.8.12",
"v0.8.11",
"v0.8.10",
"v0.8.9",
"v0.8.8",
"v0.8.4",
"v0.8.3",
"v0.8.2",
"v0.8.1",
"v0.8.0",
"v0.7.28",
"v0.7.27",
"v0.7.26",
"v0.7.25",
"v0.7.24",
"v0.7.23",
"v0.7.22",
"v0.7.21",
"v0.7.20",
"v0.7.19",
"v0.7.18",
"v0.7.17",
"v0.7.16",
"v0.7.15",
"v0.7.14",
"v0.7.13",
"v0.7.12",
"v0.7.11",
"v0.7.10",
"v0.7.9",
"v0.7.8",
"v0.7.7",
"v0.7.6",
"v0.7.5",
"v0.7.4",
"v0.7.3",
"v0.7.2",
"v0.7.1",
"v0.7.0",
"v0.6.13",
"v0.6.12",
"v0.6.11",
"v0.6.10",
"v0.6.9",
"v0.6.8",
"v0.6.7",
"v0.6.6",
"v0.6.5",
"v0.6.4",
"v0.6.3",
"v0.6.2",
"v0.6.1",
"v0.6.0",
"v0.5.9",
"v0.5.8",
"v0.5.7",
"v0.5.6",
"v0.5.5",
"v0.5.4",
"v0.5.2",
"v0.5.1",
"v0.5.0",
"v0.4.15",
"v0.4.14",
"v0.4.13",
"v0.4.12",
"v0.4.11",
"v0.4.10",
"v0.4.9",
"v0.4.8",
"v0.4.7",
"v0.4.6",
"v0.4.5",
"v0.4.4",
"v0.4.3",
"v0.4.2",
"v0.4.1",
"v0.4.0",
"v0.3.9",
"v0.3.8",
"v0.3.7",
"v0.3.6",
"v0.3.5",
"v0.3.4",
"v0.3.3",
"v0.3.2",
"v0.2.15",
"v0.2.14",
"v0.2.13",
"v0.2.12",
"v0.2.4",
"v0.2.10",
"v0.2.9",
"v0.2.8",
"v0.2.7",
"v0.2.6",
"v0.2.5",
"v0.2.3",
"v0.2.2",
"v0.2.1",
"v0.2.0",
"v0.1.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66469.json"
}
}
],
"modified": "2026-10-28T02:30:45.617620969Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66469.json",
"https://github.com/zauberzeug/nicegui/security/advisories/GHSA-72qc-wxch-74mg",
"https://nvd.nist.gov/vuln/detail/CVE-2025-66469",
"https://github.com/zauberzeug/nicegui/commit/a8fd25b7d5e23afb1952d0f60a1940e18b5f1ca8"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66469.json"
}
},
"related_cves": [
{
"value": "CVE-2025-66469",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 513846,
"published_at": "2025-12-08T23:54:37.955+00:00"
}