GHSA-m47w-xwfc-82pf: 
Python vulnerability analysis and mitigation

Summary

ui.aggrid and ui.echart evaluate option keys that start with a colon (:) as JavaScript expressions in the browser, a documented feature for passing functions like formatters or renderers. The conversion walked through the whole options object, including the row data of a grid and the dataset of a chart. A key that comes from data rather than from the application's code was therefore executed as JavaScript as well. ui.aggrid.from_pandas() and ui.aggrid.from_polars() use the column names of a DataFrame as such keys, so a column named :x caused its cell values to run as JavaScript in the browser of every user who views the grid.

Impact

Applications that display data with keys controlled by users are affected, most prominently those that render uploaded CSV or Excel files or other user-provided DataFrames with ui.aggrid.from_pandas() or ui.aggrid.from_polars(). The same applies to row data passed to ui.aggrid directly, including updates through run_grid_method() and run_row_method(), and to dataset.source of ui.echart, as long as the keys of the records come from user input. An attacker who can supply such data can execute JavaScript in the browser of other users who view it, within the application's origin, and act in their session. Applications whose data keys are defined by the application itself are not affected. Values are not evaluated, only keys starting with a colon.

Patches

Fixed in NiceGUI 3.19.0. Colon-prefixed keys are no longer evaluated inside the row data of ui.aggrid, including row data passed through grid and row methods, and inside dataset.source of ui.echart. Options outside the data keep working as documented. Upgrade to 3.19.0 or later.

Workarounds

If upgrading is not immediately possible, sanitize the keys of user-provided data before passing it to ui.aggrid or ui.echart, e.g. by renaming DataFrame columns that start with a colon: df.rename(columns=lambda c: str(c).lstrip(':')).