CVE-2026-21873
High
Description
NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site, using an iframe. This issue has been patched in version 3.5.0.
SeverityHigh
CVSS7.2
Exploit probability—
ProductZauberzeug Nicegui
PublishedJan 8, 2026
First seenJan 8, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- zauberzeug nicegui3.5.0 or later
- nicegui3.5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zauberzeug nicegui | 2.22.0 ≤ v < 3.5.0 | 3.5.0 |
| niceguiPyPI | 2.22.0 ≤ v < 3.5.0 | 3.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.