CVE
CVE-2026-21873
Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`
NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site, using an iframe. This issue has been patched in version 3.5.0.
Package Versions Affected
Package Version
patch Availability
No items found.
Automatically patch vulnerabilities without upgrading
Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request
CVSS Version
Severity
Base Score
CVSS Version
Score Vector
C
H
U
7.2
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
C
H
U
7.2
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Related Resources
No items found.
References
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21873.json, https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0, https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mhpg-c27v-6mxr, https://nvd.nist.gov/vuln/detail/CVE-2026-21873
Basic Information
Ecosystem
