PyPI/nicegui CVE-2026-21871: medium 6.1, EPSS 0.27%

NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

Action: Upgrade nicegui to 3.5.0 or later.

pip install nicegui==3.5.0

Affected

Fixed versions

Sources

• osv: GHSA-7grm-h62g-5m97
• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-7grm-h62g-5m97
• https://nvd.nist.gov/vuln/detail/CVE-2026-21871
• https://github.com/zauberzeug/nicegui
• https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0

CVE-2026-21871 · published 2026-01-08T20:00:29Z · modified 2026-07-07T17:57:28.403615598Z · JSON