← Vulnerability feed

Vulnerability record · CVE-2026-21872 · published 8 January 2026

CVE-2026-21872: Zauberzeug nicegui cross-site scripting vulnerability

Zauberzeug · Nicegui

NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the click event listener used by ui.sub_pages, combined with attacker-controlled link rendering on the page, causes XSS when the user actively clicks on the link. This issue has been patched in version 3.5.0.

6.1 CVSS 3.1 Medium EPSS 0.27% · top 82.1% CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score
0.27%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the click event listener used by ui.sub_pages, combined with attacker-controlled link rendering on the page, causes XSS when the user actively clicks on the link. This issue has been patched in version 3.5.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0 Release Notes
https://github.com/zauberzeug/nicegui/security/advisories/GHSA-m7j5-rq9j-6jj9 ExploitVendor Advisory

Track CVE-2026-21872 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-39844Zauberzeug nicegui path traversal vulnerabilityNiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can …EPSS 0.49%7.5CVE-2026-25732Zauberzeug nicegui path traversal vulnerabilityNiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitiza…EPSS 3.0%7.5CVE-2025-66645Zauberzeug nicegui path traversal vulnerabilityNiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, wh…EPSS 1.1%6.9CVE-2026-33332Zauberzeug nicegui improper input validation vulnerabilityNiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-c…EPSS 0.69%6.1CVE-2026-27156Zauberzeug nicegui cross-site scripting vulnerabilityNiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements (`Element.run_metho…EPSS 0.27%6.1CVE-2026-25516Zauberzeug nicegui cross-site scripting vulnerabilityNiceGUI is a Python-based UI framework. The ui.markdown() component uses the markdown2 library to convert markdown content to HTML, which is then ren…EPSS 0.29%6.1CVE-2026-21871Zauberzeug nicegui cross-site scripting vulnerabilityNiceGUI is a Python-based UI framework. From versions 2.13.0 to 3.4.1, there is a XSS risk in NiceGUI when developers pass attacker-controlled string…EPSS 0.28%6.1CVE-2026-21873Zauberzeug nicegui cross-site scripting vulnerabilityNiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages …EPSS 0.26%

Source: NIST National Vulnerability Database (record CVE-2026-21872), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.