What’s Vulnerable › Vulnerabilities

CVE-2025-53354: NiceGUI is vulnerable to Reflected XSS attack

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-03 · updated 2026-10-08
• Weakness: CWE-79

Description

NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting (XSS) when developers render unescaped user input into the DOM using ui.html(). NiceGUI did not enforce HTML or JavaScript sanitization, so applications that directly combine components like ui.input() with ui.html() or ui.chat_message with HTML content without escaping may allow attackers to execute arbitrary JavaScript in the user’s browser. Applications that do not pass untrusted input into ui.html() are not affected. This issue is fixed in version 3.0.0.

Affected products

• zauberzeug nicegui: before 3.0.0

References

• https://github.com/zauberzeug/nicegui/commit/4673dc35c94a0c7339e2164378b0977332e60775
• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-8c95-hpq2-w46f

Get alerted when CVE-2025-53354 or the next vulnerability affects your stack