PT-2026-2110 · Nicegui · Nicegui

Xx-Mikusan-Xx · Publicado 2026-01-08 · Atualizado 2026-01-08 · CVE-2026-21871

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NiceGUI versions 2.13.0 through 3.4.1

Description NiceGUI is a Python-based UI framework susceptible to a cross-site scripting (XSS) issue. The issue arises when developers provide attacker-controlled strings to the ui.navigate.history.push() or ui.navigate.history.replace() functions. These functions, designed as History API wrappers for updating the browser URL without a page reload, can allow a crafted payload to execute arbitrary JavaScript in the victim’s browser if the URL argument is embedded into generated JavaScript without proper escaping. Applications that do not pass untrusted input into these functions are not affected. The functions ui.navigate.history.push() and ui.navigate.history.replace() are vulnerable.

Recommendations NiceGUI versions 2.13.0 through 3.4.1 should be updated to version 3.5.0 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-21871

GHSA-7GRM-H62G-5M97

Produtos afetados

Nicegui

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21871.json · Exploit
• https://github.com/zauberzeug/nicegui · Nota
• https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0 · Nota
• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-7grm-h62g-5m97 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-21871 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-7grm-h62g-5m97 · Aviso do Fabricante
• https://t.me/CVEtracker/41707 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-21871 · Nota de Segurança
• https://twitter.com/CVEnew/status/2009208595624415464 · Publicação no Twitter