CVE-2026-21871

NiceGUI is a Python-based UI framework. From versions 2.13.0 to 3.4.1, there is a XSS risk in NiceGUI when developers pass attacker-controlled strings into ui.navigate.history.push() or ui.navigate.history.replace(). These helpers are documented as History API wrappers for updating the browser URL without page reload. However, if the URL argument is embedded into generated JavaScript without proper escaping, a crafted payload can break out of the intended string context and execute arbitrary JavaScript in the victim’s browser. Applications that do not pass untrusted input into ui.navigate.history.push/replace are not affected. This issue has been patched in version 3.5.0.

• CWE-79

• https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0Release Notes
• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-7grm-h62g-5m97Exploit, Vendor Advisory

Published

Jan 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21866Dify is an open-source LLM app development platform. Prior t…5.4
• CVE-2026-21867Rejected reason: Reason: This candidate was issued in error.
• CVE-2026-21868Flag Forge is a Capture The Flag (CTF) platform. Versions 2.…7.5
• CVE-2026-21869llama.cpp is an inference of several LLM models in C/C++. In…9.8
• CVE-2026-2187A vulnerability was found in Tenda RX3 16.03.13.11. The affe…8.8
• CVE-2026-21870BACnet Protocol Stack library provides a BACnet application …5.5
• CVE-2026-21872NiceGUI is a Python-based UI framework. From versions 2.22.0…6.1
• CVE-2026-21873NiceGUI is a Python-based UI framework. From versions 2.22.0…6.1
• CVE-2026-21874NiceGUI is a Python-based UI framework. From versions v2.10.…5.3
• CVE-2026-21875ClipBucket v5 is an open source video sharing platform. Vers…9.8
• CVE-2026-21876The OWASP core rule set (CRS) is a set of generic attack det…5.3
• CVE-2026-21877n8n is an open source workflow automation platform. In versi…9.9