CVE-2026-21871: NiceGUI XSS Vulnerability via Unescaped URL in History API Methods
Summary
CVE-2026-21871: NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace(). Affects nicegui versions >= 2.13.0, < 3.5.0. Fixed in 3.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NiceGUI is a Python library designed for building interactive web applications with ease. It provides a range of UI components and functionalities, including navigation controls that allow developers to manipulate the browser's history without reloading the page. However, this convenience comes with a security risk, as improper handling of user input can lead to cross-site scripting (XSS) vulnerabilities.
Vulnerability Detail
The vulnerability arises from the use of the ui.navigate.history.push() and ui.navigate.history.replace() methods, which do not properly escape user-controlled input. If an attacker can manipulate the input passed to these methods, they can inject malicious JavaScript code that executes in the context of the victim's browser. This can lead to various attacks, including client-side code execution, phishing UI injection, and other typical XSS impacts. The vulnerability is classified as DOM-based XSS, with a CVSS score of 6.1.
How To Fix
Latest published version: 3.18.0 as of 22 Oct 2026
pip install --upgrade "nicegui==3.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.0
This is the first release that contains the fix.
pip install --upgrade "nicegui==3.5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any user-controlled input passed to ui.navigate.history.push() or ui.navigate.history.replace() is properly sanitized or validated before use. For example, avoid directly passing user input and instead use predefined safe values.
Conclusion
The CVE-2026-21871 vulnerability in NiceGUI poses a significant risk due to improper handling of user input in history navigation methods, leading to potential XSS attacks. It is crucial for developers to update to the patched version and implement proper input validation to safeguard their applications.
See every vulnerability recorded for nicegui →
FAQ
CVE-2026-21871 is a vulnerability in the NiceGUI library that allows for cross-site scripting (XSS) attacks through unescaped URLs in history navigation methods.
You can check if your application is affected by using the Vulert playground, which allows you to monitor open-source vulnerabilities in real-time without any signup.
The potential impacts include client-side code execution, phishing UI injection, and other typical XSS consequences that can compromise user data and application integrity.
Yes, the vulnerability has been patched in NiceGUI version 3.5.0. It is recommended to update to this version or later.
If you cannot update the package, ensure that you sanitize any user input passed to the history navigation methods to prevent XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for nicegui.
