CVE-2026-21871 Details
Description
NiceGUI is a Python-based UI framework. From versions 2.13.0 to 3.4.1, there is a XSS risk in NiceGUI when developers pass attacker-controlled strings into ui.navigate.history.push() or ui.navigate.history.replace(). These helpers are documented as History API wrappers for updating the browser URL without page reload. However, if the URL argument is embedded into generated JavaScript without proper escaping, a crafted payload can break out of the intended string context and execute arbitrary JavaScript in the victim’s browser. Applications that do not pass untrusted input into ui.navigate.history.push/replace are not affected. This issue has been patched in version 3.5.0.
A cross-site scripting (XSS) vulnerability exists in NiceGUI, a Python-based UI framework, in versions 2.13.0 prior to 3.4.1. The issue arises when developers pass user-controlled strings into the 'ui.navigate.history.push()' or 'ui.navigate.history.replace()' methods. These methods are intended to update the browser URL without reloading the page. However, if the URL argument is not properly escaped before being embedded into generated JavaScript, an attacker can inject a payload that escapes the string context and executes arbitrary JavaScript in the victim's browser. This vulnerability affects any NiceGUI application that forwards untrusted input into these navigation methods.
Users can update to NiceGUI version 3.5.0, which addresses this vulnerability by properly escaping user-defined URLs in the 'ui.navigate.history.push()' and 'ui.navigate.history.replace()' methods.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0 | [email protected] | Release Notes |
| https://github.com/zauberzeug/nicegui/security/advisories/GHSA-7grm-h62g-5m97 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zauberzeug nicegui | >= 2.13.0, < 3.5.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 15, 2026 | Initial Analysis | [email protected] |
| Jan 8, 2026 | New CVE Received | [email protected] |