https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 21:55:51 +0000 https://cve.radiocsirt.org/vuln/cve-2026-25516 <p><strong>Affected:</strong> zauberzeug nicegui</p> <p>NiceGUI is a Python-based UI framework. The ui.markdown() component uses the markdown2 library to convert markdown content to HTML, which is then rendered via innerHTML. By default, markdown2 allows raw HTML to pass through unchanged. This means that if an application renders user-controlled content through ui.markdown(), an attacker can inject malicious HTML containing JavaScript event handlers. Unlike other NiceGUI components that render HTML (ui.html(), ui.chat_message(), ui.interactive_image()), the ui.markdown() component does not provide or require a sanitize parameter, leaving applications vulnerable to XSS attacks. This vulnerability is fixed in 3.7.0.</p> <p><strong>Affected:</strong> zauberzeug nicegui</p> <p>NiceGUI is a Python-based UI framework. The ui.markdown() component uses the markdown2 library to convert markdown content to HTML, which is then rendered via innerHTML. By default, markdown2 allows raw HTML to pass through unchanged. This means that if an application renders user-controlled content through ui.markdown(), an attacker can inject malicious HTML containing JavaScript event handlers. Unlike other NiceGUI components that render HTML (ui.html(), ui.chat_message(), ui.interactive_image()), the ui.markdown() component does not provide or require a sanitize parameter, leaving applications vulnerable to XSS attacks. This vulnerability is fixed in 3.7.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-25516 https://cve.radiocsirt.org/vuln/ghsa-v82v-c5x8-w282 <p><strong>Affected:</strong> PyPI: nicegui</p> <p>## Description</p> <p>The `ui.markdown()` component uses the `markdown2` library to convert markdown content to HTML, which is then rendered via `innerHTML`. By default, `markdown2` allows raw HTML to pass through unchanged. This means that if an application renders user-controlled content through `ui.markdown()`, an attacker can inject malicious HTML containing JavaScript event handlers.</p> <p>Unlike other NiceGUI components that render HTML (`ui.html()`, `ui.chat_message()`, `ui.interactive_image()`), the `ui.markdown()` component does not provide or require a `sanitize` parameter, leaving applications vulnerable to XSS attacks.</p> <p>## Proof of Concept</p> <p>```python from nicegui import ui</p> <p># User-controlled input containing malicious payload user_input = &#39;Hello! &lt;img src=x onerror=&#34;alert(\&#39;XSS\&#39;)&#34;&gt;&#39;</p> <p>ui.markdown(user_input) # XSS executes when page loads</p> <p>ui.run() ```</p> <p>When this page loads, the JavaScript in the `onerror` handler executes, potentially allowing an attacker to: - Steal session cookies or authentication tokens - Perform actions on behalf of the user - Redirect users to malicious sites - Modify page content</p> <p>## Impact</p> <p>Applications that render user-provided content through `ui.markdown()` are vulnerable to stored or reflected XSS attacks. This is particularly concerning for: - Chat applications displaying user messages - CMS or documentation systems with user-editable content - Any application that displays markdown from untrusted sources</p> <p>## Remediation</p> <p>A release has been p…</p> <p><strong>Affected:</strong> PyPI: nicegui</p> <p>## Description</p> <p>The `ui.markdown()` component uses the `markdown2` library to convert markdown content to HTML, which is then rendered via `innerHTML`. By default, `markdown2` allows raw HTML to pass through unchanged. This means that if an application renders user-controlled content through `ui.markdown()`, an attacker can inject malicious HTML containing JavaScript event handlers.</p> <p>Unlike other NiceGUI components that render HTML (`ui.html()`, `ui.chat_message()`, `ui.interactive_image()`), the `ui.markdown()` component does not provide or require a `sanitize` parameter, leaving applications vulnerable to XSS attacks.</p> <p>## Proof of Concept</p> <p>```python from nicegui import ui</p> <p># User-controlled input containing malicious payload user_input = &#39;Hello! &lt;img src=x onerror=&#34;alert(\&#39;XSS\&#39;)&#34;&gt;&#39;</p> <p>ui.markdown(user_input) # XSS executes when page loads</p> <p>ui.run() ```</p> <p>When this page loads, the JavaScript in the `onerror` handler executes, potentially allowing an attacker to: - Steal session cookies or authentication tokens - Perform actions on behalf of the user - Redirect users to malicious sites - Modify page content</p> <p>## Impact</p> <p>Applications that render user-provided content through `ui.markdown()` are vulnerable to stored or reflected XSS attacks. This is particularly concerning for: - Chat applications displaying user messages - CMS or documentation systems with user-editable content - Any application that displays markdown from untrusted sources</p> <p>## Remediation</p> <p>A release has been p…</p> https://cve.radiocsirt.org/vuln/ghsa-v82v-c5x8-w282