CVE-2026-25516
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in NiceGUI's ui.markdown() component. Attackers can inject malicious JavaScript through user-controlled markdown content, which gets rendered as HTML without sanitization. Applications using NiceGUI versions before 3.7.0 that render untrusted content via ui.markdown() are affected.
💻 Affected Systems
- NiceGUI
📦 What is this software?
Nicegui by Zauberzeug
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, session hijacking, credential theft, and client-side data exfiltration if malicious JavaScript executes in user browsers.
Likely Case
Session hijacking, defacement, or data theft from users who view attacker-controlled content.
If Mitigated
No impact if proper input sanitization or content restrictions are implemented.
🎯 Exploit Status
XSS exploitation is well-understood; no special tools required beyond ability to inject HTML/JavaScript.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.0
Vendor Advisory: https://github.com/zauberzeug/nicegui/security/advisories/GHSA-v82v-c5x8-w282
Restart Required: Yes
Instructions:
1. Update NiceGUI to version 3.7.0 or later using pip: pip install nicegui>=3.7.0
2. Restart your application
3. Verify the fix by checking that ui.markdown() now sanitizes HTML
🔧 Temporary Workarounds
Manual Input Sanitization
allSanitize all user input before passing to ui.markdown() using HTML sanitization libraries
Disable HTML in Markdown
allConfigure markdown2 library to disable raw HTML parsing
🧯 If You Can't Patch
- Implement strict content validation to reject any HTML tags in user input
- Use Content Security Policy (CSP) headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Check if your application uses NiceGUI <3.7.0 and renders user-controlled content via ui.markdown()Check Version:
pip show nicegui | grep VersionVerify Fix Applied:
Test that HTML/JavaScript in markdown input is now properly sanitized and doesn't execute📡 Detection & Monitoring
Log Indicators:
- Unusual HTML/JavaScript patterns in user-submitted content
- Multiple failed XSS attempts
Network Indicators:
- Unexpected script tags in HTTP POST data
- Suspicious JavaScript in markdown content
SIEM Query:
source="web_logs" AND ("<script" OR "javascript:" OR "onclick=" OR "onload=") AND path="*markdown*"