{"cve":"CVE-2025-53354","nvd":{"published":"2025-10-03T20:15:33.000","modified":"2026-10-08T22:10:00.563","status":"Deferred","description":"NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting (XSS) when developers render unescaped user input into the DOM using ui.html(). NiceGUI did not enforce HTML or JavaScript sanitization, so applications that directly combine components like ui.input() with ui.html() or  ui.chat_message with HTML content without escaping may allow attackers to execute arbitrary JavaScript in the user’s browser. Applications that do not pass untrusted input into ui.html() are not affected. This issue is fixed in version 3.0.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://github.com/zauberzeug/nicegui/commit/4673dc35c94a0c7339e2164378b0977332e60775","https://github.com/zauberzeug/nicegui/security/advisories/GHSA-8c95-hpq2-w46f"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:11:26.888974865+00:00"},"epss":{"cve":"CVE-2025-53354","score":0.00204,"percentile":0.10223,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-8c95-hpq2-w46f","url":"https://osv.dev/vulnerability/GHSA-8c95-hpq2-w46f","summary":"NiceGUI has a Reflected XSS","modified":"2026-07-07T17:57:19.036163158Z","packages":[{"ecosystem":"PyPI","name":"nicegui","purl":"pkg:pypi/nicegui","ranges":["<3.0.0"],"fixed":["3.0.0"]}]},{"id":"PYSEC-2026-1699","url":"https://osv.dev/vulnerability/PYSEC-2026-1699","summary":"NiceGUI has a Reflected XSS","modified":"2026-07-07T17:46:58.212785133Z","packages":[{"ecosystem":"PyPI","name":"nicegui","purl":"pkg:pypi/nicegui","ranges":["<3.0.0"],"fixed":["3.0.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}