TI-2026-17572 Aliases CVE-2026-21871 GHSA-7grm-h62g-5m97

NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

MEDIUM 60CWE-79Published 2026-01-08 · Updated 2026-01-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

NiceGUI is a Python-based UI framework. From versions 2.13.0 to 3.4.1, there is a XSS risk in NiceGUI when developers pass attacker-controlled strings into ui.navigate.history.push() or ui.navigate.history.replace(). These helpers are documented as History API wrappers for updating the browser URL without page reload. However, if the URL argument is embedded into generated JavaScript without proper escaping, a crafted payload can break out of the intended string context and execute arbitrary JavaScript in the victim’s browser. Applications that do not pass untrusted input into ui.navigate.history.push/replace are not affected. This issue has been patched in version 3.5.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00273 19th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed nicegui (zauberzeug): 3.5.0nicegui (PyPI): 3.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
zauberzeug	nicegui	2.13.0 to before 3.5.0	3.5.0	Patch available	CNA
—	nicegui (PyPI)	2.13.0 to before 3.5.0	3.5.0	Patch available	GHSA-7grm-h62g-5m97

nicegui Vendorzauberzeug Affected 2.13.0 to before 3.5.0 Fixed in 3.5.0 Patch available CNA
nicegui (PyPI) Vendor— Affected 2.13.0 to before 3.5.0 Fixed in 3.5.0 Patch available GHSA-7grm-h62g-5m97

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:zauberzeug:nicegui::::::::	2.13.0 to before 3.5.0	Vulnerable	zauberzeug

cpe:2.3:a:zauberzeug:nicegui:*:*:*:*:*:*:*:* Versions 2.13.0 to before 3.5.0 Vulnerable ·zauberzeug

Remediation

Fix · CNA nicegui (zauberzeug) Fixed in 3.5.0
Fix · GHSA-7grm-h62g-5m97 nicegui (PyPI) Fixed in 3.5.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-21871
2026-10-03 Alias added: GHSA-7grm-h62g-5m97

References

Exploit 1

https://github.com/zauberzeug/nicegui/security/advisories/GHSA-7grm-h62g-5m97

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-21871

Other 2

TI-2025-41029 NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading CVSS 3.1HIGH 7.5
TI-2026-17574 Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages` CVSS 3.1HIGH 7.2
TI-2026-17575 NiceGUI has Redis connection leak via tab storage causes service degradation CVSS 3.1MEDIUM 5.3
TI-2026-17573 NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links CVSS 3.1MEDIUM 6.1
TI-2025-40897 NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content CVSS 3.1MEDIUM 6.1
TI-2025-40896 NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection CVSS 3.1MEDIUM 6.1

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences