PT-2026-2111 · Nicegui · Nicegui
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
NiceGUI versions 2.22.0 through 3.4.1
Description
NiceGUI is a Python-based UI framework susceptible to a cross-site scripting (XSS) issue. The problem stems from an unsafe implementation within the click event listener used by
ui.sub pages, coupled with the rendering of attacker-controlled links on the page. When a user clicks on such a link, XSS can occur. The issue involves the ui.sub pages function and the handling of links.Recommendations
Upgrade to NiceGUI version 3.5.0 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nicegui