[GHSA-78qv-3mpx-9cqq] NiceGUI vulnerable to XSS via Code Injection during client-side element function execution

[evnchn]

Updates

• CVSS v4
• Severity

Comments
According to GHSA-78qv-3mpx-9cqq, authors have agreed to use CVSS 3.1 and CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1/10) for the severity assessment.

[github]

Hi there @falkoschindler! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

Aligns the advisory’s severity scoring with the upstream guidance to use a CVSS 3.1 vector and moderates the severity accordingly.

Changes:

• Removes the CVSS v4 score entry, leaving only the CVSS 3.1 vector.
• Updates the advisory severity to MODERATE.
• Bumps the modified timestamp.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This change removes the CVSS_V4 entry entirely. If the intent is only to align the severity assessment to CVSS 3.1 (per the advisory discussion), consider keeping the CVSS v4 vector alongside CVSS v3 for metadata completeness, and rely on severity/primary scoring to reflect the agreed CVSS 3.1 rating.

Suggested change

	"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
	"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
	},
	{
	"type": "CVSS_V4",
	"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"

[falkoschindler]

Thanks for the suggestion, but removing the CVSS v4 entry is intentional here.

The NiceGUI maintainers and the reporter explicitly agreed to use CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) as the authoritative assessment — see the linked advisory at zauberzeug/nicegui. Adding a CVSS v4 vector that was never part of that agreement would introduce an unsanctioned score and could diverge from what was actually coordinated.

Keeping both vectors for "metadata completeness" sounds reasonable in principle, but it creates ambiguity about which score is authoritative, especially when v4 yields a different numeric result. The advisory database should reflect what was agreed, not add extra data unilaterally.