---
id: CVE-2025-53354
title: NiceGUI is a Python-based UI framework
summary: >-
  NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk
  for Cross-Site Scripting (XSS) when developers render unescaped user input
  into the DOM using ui.html(). NiceGUI did not enforce HTML or JavaScript
  sanitizatio…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: nicegui
product: nicegui
affected:
  - nicegui < 3.0.0
patched:
  - nicegui 3.0.0
published: '2025-10-03'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T22:10:00.563'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-53354'
references:
  - url: >-
      https://github.com/zauberzeug/nicegui/commit/4673dc35c94a0c7339e2164378b0977332e60775
    label: security-advisories@github.com
  - url: >-
      https://github.com/zauberzeug/nicegui/security/advisories/GHSA-8c95-hpq2-w46f
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-53354'
  - url: 'https://github.com/zauberzeug/nicegui'
tags:
  - nvd
  - osv
  - pip
epss: 0.00204
epssPercentile: 0.10243
aliases:
  - GHSA-8c95-hpq2-w46f
  - PYSEC-2026-1699
ecosystem: pip
ingestedAt: '2026-07-08T18:25:47.432Z'
---

## Overview

NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting (XSS) when developers render unescaped user input into the DOM using ui.html(). NiceGUI did not enforce HTML or JavaScript sanitization, so applications that directly combine components like ui.input() with ui.html() or  ui.chat_message with HTML content without escaping may allow attackers to execute arbitrary JavaScript in the user’s browser. Applications that do not pass untrusted input into ui.html() are not affected. This issue is fixed in version 3.0.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2025-53354)

Affected packages:

- `nicegui < 3.0.0`

Patched in:

- `nicegui 3.0.0`

Source: https://osv.dev/vulnerability/GHSA-8c95-hpq2-w46f