jmehta10/cve-2025-66470A fast, simple scanner for detecting CVE-2025-66470 - XSS vulnerability in NiceGUI's ui.interactive_image component.
** A fast, simple scanner for detecting CVE-2025-66470 - XSS vulnerability in NiceGUI's ui.interactive_image component.
**
| Field | Value |
|---|---|
| CVE | CVE-2025-66470 |
| GHSA | GHSA-2m4f-cg75-76w2 |
| Component | ui.interactive_image |
| Affected | NiceGUI ≤ 3.3.1 |
| Fixed | NiceGUI 3.4.0+ |
| Type | Stored/Reflected XSS |
The ui.interactive_image component renders SVG content using Vue's v-html directive without sanitization, allowing XSS via <foreignObject> tag.
Vulnerable Code:
<g v-html="content"></g>
| File | Description |
|---|---|
nicegui_scanner.py | Simple scanner - Clean one-line output per target |
nicegui_xss_scanner.py | Full scanner - Detailed analysis with reports |
targets.txt | Sample targets file for batch scanning |
git clone https://github.com/yourusername/nicegui-xss-scanner.git
cd nicegui-xss-scanner
pip install requests
Single Target:
python nicegui_scanner.py http://target.com/
Batch Scan (from file):
python nicegui_scanner.py -l targets.txt
Full Analysis:
python nicegui_xss_scanner.py http://target.com/
usage: nicegui_scanner.py [-h] [-l LIST] [--timeout TIMEOUT] [target]
NiceGUI XSS Scanner - CVE-2025-66470
positional arguments:
target Target URL
options:
-h, --help Show help message
-l, --list LIST File with URLs (one per line)
--timeout TIMEOUT Request timeout (default: 10)
╔══════════════════════════════════════════════════════════════╗
║ NiceGUI XSS Scanner - CVE-2025-66470 ║
╚══════════════════════════════════════════════════════════════╝
[*] Scanning 3 target(s)...
──────────────────────────────────────────────────────────────────────
[1/3] http://192.168.1.10:8080/... 🚨 CONFIRMED (v2.1.0)
[2/3] http://192.168.1.20:5000/... ⚠ VULN_VER (v3.3.0)
[3/3] http://example.com/... ✓ NOT_NICEGUI
──────────────────────────────────────────────────────────────────────
SUMMARY:
Total scanned: 3
XSS CONFIRMED: 1
✓ Saved: nicegui_CONFIRMED_174530.txt
| Status | Meaning |
|---|---|
| 🚨 CONFIRMED | XSS vulnerability confirmed (all 3 checks passed) |
| ⚠ VULN_VER | Vulnerable version detected, needs manual testing |
| ✓ NOT_NICEGUI | Not a NiceGUI application |
For XSS to be marked as CONFIRMED, all 3 checks must pass:
<foreignObject>
<body xmlns="http://www.w3.org/1999/xhtml">
</body>
</foreignObject>
# Comments start with #
http://target1.com/
http://target2.com:8080/
https://target3.com/login
requests librarypip install requests
This tool is for authorized security testing only. Use responsibly and only on systems you have permission to test.
MIT License - See LICENSE for details.