CVE-2025-53354: NiceGUI Reflected XSS Vulnerability
Summary
CVE-2025-53354: NiceGUI has a Reflected XSS. Affects nicegui versions < 3.0.0. Fixed in 3.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NiceGUI is a Python library designed for building user interfaces with ease, allowing developers to create interactive web applications. It provides various components for user input and rendering HTML content. However, it has a significant vulnerability related to Cross-Site Scripting (XSS) due to the lack of HTML and JavaScript sanitization when rendering user input directly into the DOM.
Vulnerability Detail
The vulnerability arises from the use of the ui.html() and ui.chat_message() functions, which allow developers to bind user input directly into the DOM without any sanitization. This can lead to reflected XSS attacks, where an attacker can inject malicious scripts into the application. If user input is rendered verbatim into the page's DOM, it can enable the execution of arbitrary JavaScript in the user's browser, potentially leading to session hijacking or phishing attacks. The affected code path can be illustrated as follows: ui.input('XSS Input:', on_change=inject) followed by ui.html(f'{e.value}'). This allows any input provided by the user to be rendered directly into the DOM, creating a significant security risk.
How To Fix
Latest published version: 3.18.0 as of 22 Oct 2026
pip install --upgrade "nicegui==3.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.0
This is the first release that contains the fix.
pip install --upgrade "nicegui==3.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using ui.html() or ui.chat_message() with untrusted user input. Instead, sanitize user input before rendering it or use alternative methods that do not expose the application to XSS risks. For example, you can modify the inject function to escape HTML characters: def inject(e): safe_value = escape(e.value) ui.html(safe_value).
Conclusion
The NiceGUI library has a reflected XSS vulnerability that can lead to serious security risks if user input is not properly sanitized. It is crucial for developers to update to the latest version to protect their applications from potential attacks. Additionally, implementing input sanitization can serve as a temporary measure until the update is applied.
See every vulnerability recorded for nicegui →
FAQ
Reflected XSS is a type of security vulnerability where an attacker can inject malicious scripts into a web application, which are then executed in the user's browser.
You can check if your application is affected by using the Vulert playground, which monitors open-source vulnerabilities in real-time without requiring code access.
The potential impacts include session hijacking, phishing attacks, and unauthorized access to sensitive user data.
Yes, the patch is available in NiceGUI version 3.0.0 and later. It is recommended to update to this version to mitigate the risk.
If you cannot update immediately, implement input sanitization as a temporary workaround to prevent XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for nicegui.
