PT-2025-40595 · Nicegui · Nicegui

Oxqnd

·

Published

2025-10-03

·

Updated

2025-10-04

·

CVE-2025-53354

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions NiceGUI versions prior to 3.0.0
Description NiceGUI, a Python-based UI framework, is susceptible to Cross-Site Scripting (XSS) when developers render unescaped user input into the DOM using ui.html(). The framework did not enforce HTML or JavaScript sanitization before version 3.0.0, allowing attackers to execute arbitrary JavaScript in a user’s browser if applications directly combine components like ui.input() with ui.html() or ui.chat message with HTML content without proper escaping. The vulnerable code path occurs when user input is rendered verbatim into the page’s DOM via innerHTML. A proof of concept demonstrates that injecting a malicious payload, such as <img src=x onerror=alert('XSS')>, triggers a JavaScript alert. The issue affects applications that directly reflect user input via ui.html() or ui.chat message in HTML mode, potentially leading to client-side code execution, including session hijacking or phishing.
Recommendations Update to NiceGUI version 3.0.0 or later to resolve this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-53354
GHSA-8C95-HPQ2-W46F

Affected Products

Nicegui