NiceGUI Cross-Site Scripting Vulnerability in Subpages Component

A cross-site scripting (XSS) vulnerability has been identified in NiceGUI, a Python-based UI framework, affecting versions 2.22.0 prior to 3.4.1. The issue arises from an unsafe implementation in the click event listener for 'ui.sub_pages', which allows for the rendering of attacker-controlled links. When a user clicks on such a link, the XSS payload is executed. This vulnerability has been patched in NiceGUI version 3.5.0.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, create a NiceGUI application that uses the 'ui.sub_pages' component. Render a link that includes a JavaScript payload, such as an alert. When the link is clicked, the injected script will execute, demonstrating the XSS vulnerability.

Remediation

Users can upgrade to NiceGUI version 3.5.0, where this vulnerability has been patched.