PT-2026-2110 · Nicegui · Nicegui

Xx-Mikusan-Xx · Published 2026-01-08 · Updated 2026-01-08 · CVE-2026-21871

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NiceGUI versions 2.13.0 through 3.4.1

Description NiceGUI is a Python-based UI framework susceptible to a cross-site scripting (XSS) issue. The issue arises when developers provide attacker-controlled strings to the ui.navigate.history.push() or ui.navigate.history.replace() functions. These functions, designed as History API wrappers for updating the browser URL without a page reload, can allow a crafted payload to execute arbitrary JavaScript in the victim’s browser if the URL argument is embedded into generated JavaScript without proper escaping. Applications that do not pass untrusted input into these functions are not affected. The functions ui.navigate.history.push() and ui.navigate.history.replace() are vulnerable.

Recommendations NiceGUI versions 2.13.0 through 3.4.1 should be updated to version 3.5.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-21871

GHSA-7GRM-H62G-5M97

Affected Products

Nicegui

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21871.json · Exploit
• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-7grm-h62g-5m97 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21871 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7grm-h62g-5m97 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21871 · Security Note
• https://github.com/zauberzeug/nicegui · Note
• https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0 · Note
• https://t.me/CVEtracker/41707 · Telegram Post
• https://twitter.com/CVEnew/status/2009208595624415464 · Twitter Post