CVE-2026-21871
Description
NiceGUI is a Python-based UI framework. From versions 2.13.0 to 3.4.1, there is a XSS risk in NiceGUI when developers pass attacker-controlled strings into ui.navigate.history.push() or ui.navigate.history.replace(). These helpers are documented as History API wrappers for updating the browser URL without page reload. However, if the URL argument is embedded into generated JavaScript without proper escaping, a crafted payload can break out of the intended string context and execute arbitrary JavaScript in the victim’s browser. Applications that do not pass untrusted input into ui.navigate.history.push/replace are not affected. This issue has been patched in version 3.5.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
niceguiPyPI | >= 2.13.0, < 3.5.0 | 3.5.0 |
Affected products
3v2.13.0, v2.14.0, v2.14.1, …+ 1 more
- (no CPE)range: v2.13.0, v2.14.0, v2.14.1, …
- cpe:2.3:a:zauberzeug:nicegui:*:*:*:*:*:*:*:*range: >=2.13.0,<3.5.0
Patches
Vulnerability mechanics
References
4- github.com/zauberzeug/nicegui/security/advisories/GHSA-7grm-h62g-5m97nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-7grm-h62g-5m97ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-21871ghsaADVISORY
- github.com/zauberzeug/nicegui/releases/tag/v3.5.0nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.