Executive brief
NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
Affected products
- PyPI nicegui
Junglewise Threat Intelligence
CVE-2026-21871: PYSEC-2026-1698 - NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
CVE-2026-21871 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: nicegui (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1703 - NiceGUI has Redis connection leak via tab storage causes service degradation
- PYSEC-2026-1702 - NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
- PYSEC-2026-1701 - NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
- PYSEC-2026-1700 - NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read
- PYSEC-2026-1696 - NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content