XSS in Zauberzeug Nicegui
CVE-2026-25516
NiceGUI is a Python-based UI framework. The ui.markdown() component uses the markdown2 library to convert markdown content to HTML, which is then rendered via innerHTML. By default, markdown2 allows raw HTML to pass through unchanged. This means that if an application renders user-controlled content through ui.markdown(), an attacker can inject malicious HTML containing JavaScript event handlers. Unlike other NiceGUI components that render HTML (ui.html(), ui.chat_message(), ui.interactive_image()), the ui.markdown() component does not provide or require a sanitize parameter, leaving applications vulnerable to XSS attacks. This vulnerability is fixed in 3.7.0.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (19.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 19.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.000
Affected products
- Zauberzeug Nicegui — versions < 3.7.0
Weakness classification (CWE)
References
- github.com/zauberzeug/nicegui/security/advisories/GHSA-v82v-c5x8-w282 (Exploit, Mitigation, Vendor Advisory)
- github.com/zauberzeug/nicegui/commit/f1f7533577875af7d23f161ed3627f73584cb561 (Patch)
Frequently asked questions
- What is CVE-2026-25516?
- CVE-2026-25516 is a medium-severity vulnerability in Zauberzeug Nicegui, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-02-06.
- How severe is CVE-2026-25516?
- Medium severity. CVSS v3 base score is 6.1 out of 10.