CVE-2026-25516

MEDIUM EPSS 15.1%
Published Feb 6, 20264mo ago · Modified Jun 17, 20262w ago
6.1 CVSS 3.1
Medium
Find Similar
Published Feb 6, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

NiceGUI is a Python-based UI framework. The ui.markdown() component uses the markdown2 library to convert markdown content to HTML, which is then rendered via innerHTML. By default, markdown2 allows raw HTML to pass through unchanged. This means that if an application renders user-controlled content through ui.markdown(), an attacker can inject malicious HTML containing JavaScript event handlers. Unlike other NiceGUI components that render HTML (ui.html(), ui.chat_message(), ui.interactive_image()), the ui.markdown() component does not provide or require a sanitize parameter, leaving applications vulnerable to XSS attacks. This vulnerability is fixed in 3.7.0.

CVSS Details

Base Score
6.1
Exploitability
2.8
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
15.1% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
zauberzeugnicegui* <3.7.0

References 2

  • github.com https://github.com/zauberzeug/nicegui/commit/f1f7533577875af7d23f161ed3627f73584cb561
    Patch
  • github.com https://github.com/zauberzeug/nicegui/security/advisories/GHSA-v82v-c5x8-w282
    ExploitMitigationVendor Advisory

Remediation

  • github.com https://github.com/zauberzeug/nicegui/commit/f1f7533577875af7d23f161ed3627f73584cb561
    Patch