CVE-2025-53354: Nicegui Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8c95-hpq2-w46f",
  "modified" : "2025-10-13T15:10:03Z",
  "published" : "2025-10-03T19:19:17Z",
  "aliases" : [ "CVE-2025-53354" ],
  "summary" : "NiceGUI has a Reflected XSS",
  "details" : "### Summary\n\nA Cross-Site Scripting (XSS) risk exists in NiceGUI when developers render unescaped user input into the DOM using `ui.html()`. Before version 3.0, NiceGUI does not enforce HTML or JavaScript sanitization, so applications that directly combine components like `ui.input()` with `ui.html()` without escaping may allow attackers to execute arbitrary JavaScript in the user’s browser. Same holds for `ui.chat_message` with HTML content.\n\nApplications that directly reflect user input via `ui.html()` (or `ui.chat_message` in HTML mode) are affected. This may lead to client-side code execution (e.g., session hijacking or phishing). Applications that do not pass untrusted input into ui.html() are not affected.\n\n### Details\n\nNiceGUI allows developers to bind user input directly into the DOM using `ui.html()` or `ui.chat_message()`. However, the library does not enforce any HTML or JavaScript sanitization, which potentially creates a dangerous attack surface for developers unaware of this behavior.\n\nThe vulnerable code path appears when combining these:\n\n```python\nui.input(\"XSS Input:\", on_change=inject)\ndef inject(e):\n    ui.html(f'{e.value}')\n```\n\nIn this setup, any input provided by the user is rendered **verbatim** into the page’s DOM via innerHTML, enabling injection of script-based payloads.\n\n### PoC (Proof of Concept)\n\n1. Create a simple app:\n\n   ```python\n   from nicegui import ui\n\n   @ui.page('/')\n   def main():\n       def inject(e):\n           ui.html(f'{e.value}')  # vulnerable use\n\n       ui.input(\"XSS Input:\", on_change=inject)\n\n   ui.run()\n   ```\n\n2. Run the app:\n\n   ```bash\n   python app.py\n   ```\n\n3. In the browser, input the following payload:\n\n   ```html\n   <img src=x onerror=alert('XSS')>\n   ```\n\n4. Observe the JavaScript alert popup:\n\n   ```\n   XSS\n   ```\n\n### Impact\n\n* **Vulnerability type:** Reflected Cross-Site Scripting (XSS)\n* **Attack vector:** User input rendered as raw HTML\n* **Affected users:** Any NiceGUI-based application using `ui.html()` or `ui.chat_message()` with HTML content from user input",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "nicegui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.0.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/zauberzeug/nicegui/security/advisories/GHSA-8c95-hpq2-w46f"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-53354"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/zauberzeug/nicegui/commit/4673dc35c94a0c7339e2164378b0977332e60775"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/zauberzeug/nicegui"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-10-03T19:19:17Z",
    "nvd_published_at" : "2025-10-03T20:15:33Z"
  }
}