Executive brief
NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
Affected products
- PyPI nicegui
Junglewise Threat Intelligence
CVE-2025-66469: PYSEC-2026-1697 - NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
CVE-2025-66469 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: nicegui (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1703 - NiceGUI has Redis connection leak via tab storage causes service degradation
- PYSEC-2026-1702 - NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
- PYSEC-2026-1701 - NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
- PYSEC-2026-1698 - NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
- PYSEC-2026-1700 - NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read