CVE-2026-21873: NiceGUI Zero-Click XSS Vulnerability in ui.sub_pages
Summary
CVE-2026-21873: NiceGUI apps which use ui.sub_pages vulnerable to zero-click XSS. Affects nicegui versions >= 2.22.0, < 3.5.0. Fixed in 3.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NiceGUI is an open-source Python framework that allows developers to create interactive web applications easily. It provides a modern way to build Single-Page Applications (SPAs) using Python, promoting the use of components like ui.sub_pages for seamless navigation. However, this framework has a vulnerability that can be exploited through its sub-pages functionality, allowing attackers to execute malicious scripts without user interaction.
Vulnerability Detail
The vulnerability arises from an unsafe implementation in the pushstate event listener used by ui.sub_pages. An attacker can manipulate the fragment identifier of the URL through an iframe, leading to a zero-click Cross-Site Scripting (XSS) attack. The vulnerability is triggered when the _handle_scrolling method processes a fragment that has escaped quotes, allowing the execution of arbitrary JavaScript. This can result in unauthorized access to sensitive information or actions being performed on behalf of the user.
How To Fix
Latest published version: 3.18.0 as of 22 Oct 2026
pip install --upgrade "nicegui==3.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.0
This is the first release that contains the fix.
pip install --upgrade "nicegui==3.5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, you can implement the following middleware to block iframe embedding, which mitigates the risk of this vulnerability:
@app.middleware('http')
async def iframe_blocking_middleware(request, call_next):
response = await call_next(request)
response.headers['X-Frame-Options'] = 'DENY'
return response
Conclusion
The CVE-2026-21873 vulnerability in NiceGUI's ui.sub_pages presents a significant risk due to its zero-click XSS nature. It is crucial for developers using this framework to update to the latest version or implement workarounds to safeguard their applications from potential attacks.
See every vulnerability recorded for nicegui →
FAQ
The vulnerability is a zero-click XSS that allows attackers to execute scripts without any user interaction by manipulating the URL fragment.
Versions of NiceGUI prior to 3.5.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized script execution, which can lead to data theft or manipulation of user actions within the application.
Yes, you can implement middleware to block iframe embedding, which reduces the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for nicegui.
