Cross-Site Vulnerability in NiceGUI UI Framework by Zauberzeug
CVE-2026-21873

7.2HIGH

Key Information:

Vendor

Zauberzeug

Status
Nicegui
Vendor
CVE Published:
8 January 2026

What is CVE-2026-21873?

The NiceGUI UI framework, developed by Zauberzeug, contains a cross-site vulnerability in its pushstate event listener, which allows attackers to manipulate the URL's fragment identifier even when the requests originate from different domains through the use of an iframe. This security flaw was present in versions 2.22.0 to 3.4.1 and could lead to potential exploitation if left unaddressed. Users are advised to update to version 3.5.0 or later, where this vulnerability has been patched.

Affected Version(s)

nicegui >= 2.22.0, < 3.5.0

References

https://github.com/zauberzeug/nicegui/security/advisories...
x_refsource_CONFIRM
https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.