Cross-Site Scripting Risk in NiceGUI Framework by Zauberzeug

CVE-2025-53354

What is CVE-2025-53354?

The NiceGUI framework, utilized for developing web applications with Python, is susceptible to Cross-Site Scripting (XSS) in versions prior to 3.0.0. This vulnerability occurs when developers render unescaped user input into the Document Object Model (DOM) using the function ui.html(). Without proper HTML or JavaScript sanitization, malicious actors can inject and execute arbitrary JavaScript within users' browsers, compromising application security. Applications that refrain from embedding untrusted input in ui.html() remain unaffected. Users are urged to upgrade to version 3.0.0 to mitigate this risk. For more details, refer to the advisory on GitHub and related commit.

References