7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-21873

CVE-2026-21873: Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`

NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site, using an iframe. This issue has been patched in version 3.5.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-21873

CVE-2026-21873:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nicegui	pip	>= 2.22.0, <= 3.4.1	3.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Cross-Site Scripting (XSS) issue within the ui.sub_pages feature of NiceGUI. The root cause is the improper handling of user-controlled parts of the URL, specifically the URL fragment and path, when generating JavaScript code on the server-side to be executed on the client.

The primary vulnerability, as detailed in the advisory, exists in the SubPages._scroll_to_fragment method. This method takes a URL fragment and uses it to construct a JavaScript snippet to scroll to a specific element. The fragment is not sanitized, allowing an attacker to inject arbitrary JavaScript by crafting a malicious URL fragment. The SubPages._handle_scrolling method is the entry point for this vulnerability, as it reads the fragment from the URL and passes it to _scroll_to_fragment.

A similar vulnerability was patched in the same release within the SubPagesRouter._handle_navigate method. This function used the current path to generate a JavaScript call to history.pushState without sanitization, creating another XSS vector through a malicious path.

The patches for both issues involve using json.dumps to properly escape the fragment and path strings before they are embedded into the JavaScript code, preventing the injection of malicious scripts. Any runtime profile during exploitation would show calls to SubPages._handle_scrolling and SubPages._scroll_to_fragment for the fragment-based XSS, or SubPagesRouter._handle_navigate for the path-based XSS.

Vulnerable functions

SubPages._scroll_to_fragment

nicegui/elements/sub_pages.py

The function `_scroll_to_fragment` in the `SubPages` class directly incorporates the `fragment` string into a JavaScript `document.querySelector` call without proper escaping. An attacker can provide a malicious URL fragment (e.g., `#x');alert(1)//`) which breaks out of the string literal in the generated JavaScript and executes arbitrary code in the user's browser. The patch fixes this by using `json.dumps` to safely encode the fragment before it is embedded in the JavaScript string.

SubPages._handle_scrolling

nicegui/elements/sub_pages.py

This function retrieves the URL fragment from `self.client.page.url.fragment` and passes it directly to the vulnerable `_scroll_to_fragment` function. As it handles the tainted input and initiates the vulnerable action, it is a key part of the exploitation chain.

SubPagesRouter._handle_navigate

nicegui/sub_pages_router.py

The function `_handle_navigate` in the `SubPagesRouter` class constructs a JavaScript `history.pushState` call using `self.current_path` without proper escaping. A malicious path could be crafted to inject and execute arbitrary JavaScript. The patch addresses this by using `json.dumps` to sanitize the path.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.