CVE-2026-25516

NiceGUI is a Python-based UI framework. The ui.markdown component uses the markdown2 library to convert markdown content to HTML, which is then rendered via innerHTML. By default, markdown2 allows raw HTML to pass through unchanged. This means that if an application renders user-controlled conten...

rosys (0.5.13) potentially affected by CVE-2026-25516 via nicegui (0.7.15)

nicegui PYPI version 0.7.15 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.5.13 Source cves: CVE-2026-25516 Source advisory: OSV:PYSEC-2026-2231...

ai-plays-jackbox (>=0.0.1, <=0.3.2), air-link (>=0.3.0, <=0.5.0) +23 more potentially affected by CVE-2026-25516 via nicegui (2.24.2)

nicegui PYPI version 2.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - ai-plays-jackbox =0.0.1, =0.3.0, =0.8.0, =1.11.0b1, =0.13.24, =0.2.14, =0.30.0, =2.0.0, =0.2.0, =0.2.0, =0.0.1, =0.0.4 and more Source cves:...

aignostics (>=0.2.200, <=0.2.226), bindmc (>=0.1.3, <=0.1.11) +6 more potentially affected by CVE-2026-25516 via nicegui (>=3.0.0rc1, <=3.6.1)

nicegui PYPI version =3.0.0rc1, =0.2.200, =0.1.3, =0.9.0, =0.3.1, =0.4.24, =0.4.25 - relationalai 0.13.6 - synth-mapping-helper 1.5.20 Source cves: CVE-2026-25516 Source advisory: OSV:PYSEC-2026-2231...

rosys (>=0.5.22, <=0.5.24) potentially affected by CVE-2026-25516 via nicegui (0.7.29)

nicegui PYPI version 0.7.29 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.22, =0.5.24 Source cves: CVE-2026-25516 Source advisory: OSV:PYSEC-2026-2231...

haywire-core (0.0.2), openorchestrator (>=2.0.0rc1, <=3.0.0) +1 more potentially affected by CVE-2026-25516 via nicegui (2.22.2)

nicegui PYPI version 2.22.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - haywire-core 0.0.2 - openorchestrator =2.0.0rc1, =3.0.0 - space-stream 0.1.3 Source cves: CVE-2026-25516 Source advisory: OSV:PYSEC-2026-2231...

rosys (0.7.1) potentially affected by CVE-2026-25516 via nicegui (1.0.4)

nicegui PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.7.1 Source cves: CVE-2026-25516 Source advisory: OSV:PYSEC-2026-2231...

openadapt (0.7.1) potentially affected by CVE-2026-25516 via nicegui (1.2.16)

nicegui PYPI version 1.2.16 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - openadapt 0.7.1 Source cves: CVE-2026-25516 Source advisory: OSV:PYSEC-2026-2231...

relationalai (>=0.11.4, <=0.13.5) potentially affected by CVE-2026-25516 via nicegui (2.16.1)

nicegui PYPI version 2.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - relationalai =0.11.4, =0.13.5 Source cves: CVE-2026-25516 Source advisory: OSV:PYSEC-2026-2231...

nice-gui-utils (>=0.1.2, <=0.1.5) potentially affected by CVE-2026-25516 via nicegui (1.4.2)

nicegui PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - nice-gui-utils =0.1.2, =0.1.5 Source cves: CVE-2026-25516 Source advisory: OSV:PYSEC-2026-2231...

rosys (>=0.8.4, <=0.8.5) potentially affected by CVE-2026-25516 via nicegui (1.2.17)

nicegui PYPI version 1.2.17 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.8.4, =0.8.5 Source cves: CVE-2026-25516 Source advisory: OSV:PYSEC-2026-2231...

nice-gui-utils (>=0.1.2.dev0, <=0.1.2.dev3) potentially affected by CVE-2026-25516 via nicegui (1.4.1)

nicegui PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - nice-gui-utils =0.1.2.dev0, =0.1.2.dev3 Source cves: CVE-2026-25516 Source advisory: OSV:PYSEC-2026-2231...

nice-gui-utils (0.1.6) potentially affected by CVE-2026-25516 via nicegui (1.4.3)

nicegui PYPI version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - nice-gui-utils 0.1.6 Source cves: CVE-2026-25516 Source advisory: OSV:PYSEC-2026-2231...

kayalab (>=0.1.0, <=0.7.29) potentially affected by CVE-2026-25516 via nicegui (1.4.13)

nicegui PYPI version 1.4.13 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - kayalab =0.1.0, =0.7.29 Source cves: CVE-2026-25516 Source advisory: OSV:PYSEC-2026-2231...

air-link (>=0.0.0, <=0.2.1), broh5 (1.3.2) +16 more potentially affected by CVE-2026-25516 via nicegui (1.4.37)

nicegui PYPI version 1.4.37 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - air-link =0.0.0, =0.1.0, =1.1.3, =0.6.7, =1.0.0, =1.14.5, =0.0.2a5, =1.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves:...

CVE-2026-25516 NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content

NiceGUI is a Python-based UI framework. The ui.markdown component uses the markdown2 library to convert markdown content to HTML, which is then rendered via innerHTML. By default, markdown2 allows raw HTML to pass through unchanged. This means that if an application renders user-controlled conten...

rosys (>=0.4.10, <=0.4.12) potentially affected by CVE-2026-25516 via nicegui (0.6.10)

nicegui PYPI version 0.6.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.4.10, =0.4.12 Source cves: CVE-2026-25516 Source advisory: OSV:GHSA-V82V-C5X8-W282...

openadapt (>=0.17.0, <=0.26.2) potentially affected by CVE-2026-25516 via nicegui (1.4.9)

nicegui PYPI version 1.4.9 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - openadapt =0.17.0, =0.26.2 Source cves: CVE-2026-25516 Source advisory: OSV:GHSA-V82V-C5X8-W282...

rosys (>=0.3.3, <=0.4.5) potentially affected by CVE-2026-25516 via nicegui (0.6.5)

nicegui PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.3.3, =0.4.5 Source cves: CVE-2026-25516 Source advisory: OSV:GHSA-V82V-C5X8-W282...

aignostics (>=0.2.200, <=0.2.226), bindmc (>=0.1.3, <=0.1.11) +6 more potentially affected by CVE-2026-25516 via nicegui (>=3.0.0rc1, <=3.6.1)

nicegui PYPI version =3.0.0rc1, =0.2.200, =0.1.3, =0.9.0, =0.3.1, =0.4.24, =0.4.25 - relationalai 0.13.6 - synth-mapping-helper 1.5.20 Source cves: CVE-2026-25516 Source advisory: GHSA-V82V-C5X8-W282...