CVE-2026-21871
Medium · 6.1NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
CVSS
6.1
EPSS
0.3%
Published
Jan 8, 2026
CISA due date
—
The record
XSS risk exists in NiceGUI when developers pass attacker-controlled strings into `ui.navigate.history.push()` or `ui.navigate.history.replace()`. These helpers are documented as History API wrappers for updating the browser URL without page reload. However, if the URL argument is embedded into generated JavaScript without proper escaping, a crafted payload can break out of the intended string context and execute arbitrary JavaScript in the victim’s browser. **Applications that do not pass untrusted input into `ui.navigate.history.push/replace` are not affected.**
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | nicegui | 2.13.0 | 3.5.0 |
| pypi | nicegui | 2.13.0 | No fix |
Related vulnerabilities
- GHSA-7grm-h62g-5m97 NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace() Same vulnerability
- GHSA-78qv-3mpx-9cqq NiceGUI vulnerable to XSS via Code Injection during client-side element function execution Also affects nicegui
- CVE-2026-27156 NiceGUI is a Python-based UI framework. Also affects nicegui
- CVE-2026-25732 NiceGUI is a Python-based UI framework. Also affects nicegui
- CVE-2026-25516 NiceGUI is a Python-based UI framework. Also affects nicegui
- GHSA-9ffm-fxg3-xrhh NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write Also affects nicegui
- GHSA-v82v-c5x8-w282 NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution… Also affects nicegui
- GHSA-mp55-g7pj-rvm2 NiceGUI has Redis connection leak via tab storage causes service degradation Also affects nicegui