CVE-2026-21871: NiceGUI XSS Vulnerability

CVE-2026-21871 Overview

CVE-2026-21871 is a Cross-Site Scripting (XSS) vulnerability affecting NiceGUI, a Python-based UI framework. The vulnerability exists in versions 2.13.0 through 3.4.1 and allows attackers to execute arbitrary JavaScript in a victim's browser when developers pass attacker-controlled strings into the ui.navigate.history.push() or ui.navigate.history.replace() functions.

These helper functions are documented as History API wrappers designed to update the browser URL without triggering a page reload. However, when a URL argument is embedded into generated JavaScript without proper escaping, a crafted payload can break out of the intended string context and execute malicious scripts.

Critical Impact

Attackers can execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking, credential theft, or malicious content injection.

Affected Products

• NiceGUI versions 2.13.0 through 3.4.1
• Applications using ui.navigate.history.push() with untrusted input
• Applications using ui.navigate.history.replace() with untrusted input

Discovery Timeline

• 2026-01-08 - CVE CVE-2026-21871 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-21871

Vulnerability Analysis

This XSS vulnerability stems from improper input sanitization within NiceGUI's History API wrapper functions. The ui.navigate.history.push() and ui.navigate.history.replace() methods accept URL strings that are subsequently embedded into dynamically generated JavaScript code. Without proper escaping mechanisms, an attacker who controls the input to these functions can craft malicious payloads that escape the intended string context.

When exploited, this vulnerability allows arbitrary JavaScript execution within the victim's browser, operating under the same origin as the vulnerable NiceGUI application. This can compromise user sessions, exfiltrate sensitive data, or perform actions on behalf of authenticated users.

Applications that do not pass untrusted or user-controlled input into these navigation functions remain unaffected by this vulnerability.

Root Cause

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability arises because URL arguments passed to the History API helper functions are embedded into JavaScript code without adequate escaping or sanitization. This allows specially crafted input strings containing JavaScript syntax characters to break out of the string literal context and inject executable code.

Attack Vector

The attack requires user interaction and operates over the network. An attacker must convince a developer-built application to pass a malicious URL string to either ui.navigate.history.push() or ui.navigate.history.replace(). This typically occurs when:

1. User input is directly passed to these navigation functions without validation
2. URL parameters or form data are used to construct history entries
3. External data sources provide URL values that are trusted without sanitization

The payload would include JavaScript escape sequences and code that, when processed by the client's browser, executes outside the intended string context. For technical details on the exploitation mechanism, refer to the GitHub Security Advisory GHSA-7grm-h62g-5m97.

Detection Methods for CVE-2026-21871

Indicators of Compromise

• Unusual JavaScript execution errors in browser console logs related to History API calls
• Unexpected URL patterns containing JavaScript syntax characters in application logs
• Reports of suspicious browser behavior or redirects from application users
• Network traffic containing encoded JavaScript payloads in URL parameters

Detection Strategies

• Implement Content Security Policy (CSP) headers with strict script-src directives to detect and block inline script execution
• Monitor application logs for URL inputs containing suspicious characters such as <, >, ', ", (, ), and encoded variants
• Use Web Application Firewalls (WAF) with XSS detection rules to identify malicious payloads targeting navigation functions
• Conduct code reviews to identify all usages of ui.navigate.history.push() and ui.navigate.history.replace() with dynamic input

Monitoring Recommendations

• Enable verbose logging for all user-supplied inputs that flow into navigation functions
• Set up alerts for CSP violation reports that may indicate attempted XSS exploitation
• Monitor client-side error reporting services for JavaScript execution anomalies
• Track application behavior for unauthorized DOM modifications or unexpected script executions

How to Mitigate CVE-2026-21871

Immediate Actions Required

• Upgrade NiceGUI to version 3.5.0 or later immediately
• Audit all application code for usages of ui.navigate.history.push() and ui.navigate.history.replace() with user-controlled input
• Implement input validation and sanitization for any data passed to navigation functions
• Deploy Content Security Policy headers to provide defense-in-depth against XSS attacks

Patch Information

The vulnerability has been patched in NiceGUI version 3.5.0. Organizations should upgrade to this version or later to remediate the vulnerability. The patch implements proper escaping for URL arguments before they are embedded into generated JavaScript code.

For detailed release information, see the GitHub Release v3.5.0. Additional security context is available in the GitHub Security Advisory GHSA-7grm-h62g-5m97.

Workarounds

• Avoid passing user-controlled or untrusted input directly to ui.navigate.history.push() or ui.navigate.history.replace()
• Implement strict allowlist validation for any URL values before passing them to navigation functions
• Use URL encoding and sanitization libraries to escape potentially dangerous characters in user input
• Consider implementing a proxy function that validates and sanitizes URLs before calling the underlying History API methods

# Configuration example - Upgrade NiceGUI to patched version
pip install --upgrade nicegui>=3.5.0

# Verify installed version
pip show nicegui | grep Version