CVE-2026-21873

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site, using an iframe. This issue has been patched in version 3.5.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
zauberzeug	nicegui	>= 2.22.0, < 3.5.0

References

https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0Release Notes
https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mhpg-c27v-6mxrExploit, Vendor Advisory

Timeline

Published: Jan 8, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-218745.3NiceGUI is a Python-based UI framework. From versions v2.10.0 to 3.4.1, an unauthenticated attacker can exhaust Redis connections by repeate CVE-2026-218759.8ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection throu CVE-2026-218765.3The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to version CVE-2026-218779.9n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute maliciou CVE-2026-218787.5BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0.rc3, a vulnerability has been discovered CVE-2026-218796.1Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack t CVE-2026-21887.2A vulnerability was determined in UTT 进取 521G 3.1.1-190816. The impacted element is the function sub_446B18 of the file /goform/formPdbUpCon CVE-2026-218805.3Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the CVE-2026-218819.1Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication CVE-2026-218828.4theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper p CVE-2026-218835.4Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist (e CVE-2026-218848.2React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability