Executive brief
NiceGUI has a Reflected XSS
Affected products
- PyPI nicegui
Junglewise Threat Intelligence
CVE-2025-53354: PYSEC-2026-1699 - NiceGUI has a Reflected XSS
CVE-2025-53354 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: nicegui (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1703 - NiceGUI has Redis connection leak via tab storage causes service degradation
- PYSEC-2026-1702 - NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
- PYSEC-2026-1701 - NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
- PYSEC-2026-1698 - NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
- PYSEC-2026-1700 - NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read