XSS Vulnerability in NiceGUI Python UI Framework

CVE-2026-25516

What is CVE-2026-25516?

The NiceGUI framework, a Python-based UI solution, features a ui.markdown() component vulnerable to cross-site scripting (XSS) due to its reliance on the markdown2 library for converting markdown into HTML. This component does not sanitize user input, allowing attackers to inject malicious HTML and JavaScript event handlers into applications that render user-controlled content. Unlike other components in NiceGUI that offer sanitization, ui.markdown() exposes applications to serious security threats. Users are advised to update to version 3.7.0 or later to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References