CVE-2026-21872: NiceGUI Python Framework XSS Vulnerability

CVE-2026-21872 Overview

CVE-2026-21872 is a Cross-Site Scripting (XSS) vulnerability affecting NiceGUI, a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the click event listener used by ui.sub_pages, combined with attacker-controlled link rendering on the page, causes XSS when the user actively clicks on the link. This vulnerability allows attackers to execute arbitrary JavaScript code in the context of the victim's browser session.

Critical Impact

Attackers can leverage this XSS vulnerability to steal session cookies, hijack user sessions, redirect users to malicious sites, or perform unauthorized actions on behalf of authenticated users within NiceGUI applications.

Affected Products

• NiceGUI versions 2.22.0 through 3.4.1
• Python applications using NiceGUI's ui.sub_pages component
• Web interfaces built with vulnerable NiceGUI versions

Discovery Timeline

• 2026-01-08 - CVE-2026-21872 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-21872

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The flaw exists in how NiceGUI handles click events within the ui.sub_pages component. When an attacker can control the content of links rendered on the page, the unsafe implementation of the click event listener fails to properly sanitize user input before processing it.

The attack requires user interaction—specifically, the victim must click on a malicious link crafted by the attacker. This makes it a reflected or stored XSS depending on how the attacker-controlled content is persisted within the application.

Root Cause

The root cause lies in insufficient input validation and output encoding within NiceGUI's ui.sub_pages click event listener implementation. The component does not properly sanitize or escape attacker-controlled data before incorporating it into the DOM or executing JavaScript handlers. This allows malicious payloads embedded in link attributes to be executed when users interact with the rendered content.

Attack Vector

The attack is network-based and requires user interaction. An attacker must first inject malicious content into a NiceGUI application that uses the ui.sub_pages component. This could occur through:

• User-supplied input fields that render links on sub-pages
• Database content that gets rendered without proper sanitization
• URL parameters reflected back into the page content

When a user clicks on the attacker-controlled link, the malicious JavaScript payload executes in the user's browser context, potentially allowing session hijacking, credential theft, or unauthorized actions.

The vulnerability mechanism exploits improper handling of user-controlled input within the ui.sub_pages click event listener. When attacker-controlled content is rendered as clickable links, the event handler processes this content without adequate sanitization, allowing JavaScript execution. For detailed technical analysis, see the GitHub Security Advisory GHSA-m7j5-rq9j-6jj9.

Detection Methods for CVE-2026-21872

Indicators of Compromise

• Unusual JavaScript execution patterns originating from ui.sub_pages components
• Unexpected outbound network requests to unknown domains from client browsers
• Session cookie exfiltration attempts in web server logs
• Modified or injected link elements containing JavaScript payloads within NiceGUI pages

Detection Strategies

• Monitor web application logs for suspicious link parameters containing JavaScript syntax (e.g., javascript:, onerror=, onclick=)
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Use Web Application Firewalls (WAF) with XSS detection rules to identify malicious payloads
• Deploy browser-based XSS auditing tools to identify vulnerable click handlers

Monitoring Recommendations

• Enable verbose logging for NiceGUI applications to capture user interactions with ui.sub_pages components
• Monitor for anomalous user session behavior that may indicate session hijacking
• Set up alerts for CSP violation reports which may indicate XSS exploitation attempts
• Review application logs for encoded or obfuscated JavaScript patterns in user input

How to Mitigate CVE-2026-21872

Immediate Actions Required

• Upgrade NiceGUI to version 3.5.0 or later immediately
• Audit existing NiceGUI applications for usage of the ui.sub_pages component with user-controlled content
• Implement input validation and output encoding for all user-supplied data rendered on pages
• Deploy Content Security Policy headers to mitigate potential XSS impact

Patch Information

The NiceGUI development team has addressed this vulnerability in version 3.5.0. The patch fixes the unsafe click event listener implementation in the ui.sub_pages component by properly sanitizing user input before processing. For detailed information about the fix, refer to the GitHub Release v3.5.0.

Workarounds

• Avoid rendering user-controlled content as clickable links within ui.sub_pages until the patch is applied
• Implement server-side input sanitization to strip potentially malicious JavaScript from link content
• Use allowlisting for permitted URL schemes (e.g., only http:// and https://) to block javascript: URLs
• Deploy a strict Content Security Policy to prevent inline script execution as a defense-in-depth measure

# Upgrade NiceGUI to patched version
pip install --upgrade nicegui>=3.5.0

# Verify installed version
pip show nicegui | grep Version