Cross-Site Scripting Risk in NiceGUI Framework by Zauberzeug

CVE-2025-53354

What is CVE-2025-53354?

The NiceGUI framework, utilized for developing web applications with Python, is susceptible to Cross-Site Scripting (XSS) in versions prior to 3.0.0. This vulnerability occurs when developers render unescaped user input into the Document Object Model (DOM) using the function ui.html(). Without proper HTML or JavaScript sanitization, malicious actors can inject and execute arbitrary JavaScript within users' browsers, compromising application security. Applications that refrain from embedding untrusted input in ui.html() remain unaffected. Users are urged to upgrade to version 3.0.0 to mitigate this risk. For more details, refer to the advisory on GitHub and related commit.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References