Publish GHSA-8c95-hpq2-w46f

Author: advisory-database[bot]

advisories/github-reviewed/2025/10/GHSA-8c95-hpq2-w46f/GHSA-8c95-hpq2-w46f.json

@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8c95-hpq2-w46f",
+  "modified": "2025-10-03T19:19:17Z",
+  "published": "2025-10-03T19:19:17Z",
+  "aliases": [
+    "CVE-2025-53354"
+  ],
+  "summary": "NiceGUI has a Reflected XSS",
+  "details": "### Summary\n\nA Cross-Site Scripting (XSS) risk exists in NiceGUI when developers render unescaped user input into the DOM using `ui.html()`. Before version 3.0, NiceGUI does not enforce HTML or JavaScript sanitization, so applications that directly combine components like `ui.input()` with `ui.html()` without escaping may allow attackers to execute arbitrary JavaScript in the user’s browser. Same holds for `ui.chat_message` with HTML content.\n\nApplications that directly reflect user input via `ui.html()` (or `ui.chat_message` in HTML mode) are affected. This may lead to client-side code execution (e.g., session hijacking or phishing). Applications that do not pass untrusted input into ui.html() are not affected.\n\n### Details\n\nNiceGUI allows developers to bind user input directly into the DOM using `ui.html()` or `ui.chat_message()`. However, the library does not enforce any HTML or JavaScript sanitization, which potentially creates a dangerous attack surface for developers unaware of this behavior.\n\nThe vulnerable code path appears when combining these:\n\n```python\nui.input(\"XSS Input:\", on_change=inject)\ndef inject(e):\n    ui.html(f'{e.value}')\n```\n\nIn this setup, any input provided by the user is rendered **verbatim** into the page’s DOM via innerHTML, enabling injection of script-based payloads.\n\n### PoC (Proof of Concept)\n\n1. Create a simple app:\n\n   ```python\n   from nicegui import ui\n\n   @ui.page('/')\n   def main():\n       def inject(e):\n           ui.html(f'{e.value}')  # vulnerable use\n\n       ui.input(\"XSS Input:\", on_change=inject)\n\n   ui.run()\n   ```\n\n2. Run the app:\n\n   ```bash\n   python app.py\n   ```\n\n3. In the browser, input the following payload:\n\n   ```html\n   <img src=x onerror=alert('XSS')>\n   ```\n\n4. Observe the JavaScript alert popup:\n\n   ```\n   XSS\n   ```\n\n### Impact\n\n* **Vulnerability type:** Reflected Cross-Site Scripting (XSS)\n* **Attack vector:** User input rendered as raw HTML\n* **Affected users:** Any NiceGUI-based application using `ui.html()` or `ui.chat_message()` with HTML content from user input",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "nicegui"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.0.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/zauberzeug/nicegui/security/advisories/GHSA-8c95-hpq2-w46f"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/zauberzeug/nicegui/commit/4673dc35c94a0c7339e2164378b0977332e60775"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/zauberzeug/nicegui"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-10-03T19:19:17Z",
+    "nvd_published_at": null
+  }
+}