CVE-2026-21872CWE-79

NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

Medium · published January 8, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
18.3
In the wild
Unconfirmed
What it is

NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the click event listener used by ui.sub_pages, combined with attacker-controlled link rendering on the page, causes XSS when the user actively clicks on the link. This issue has been patched in version 3.5.0.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00271 · 18.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-01-08T09:50Z
EPSS history
Timeline
  • 08 JAN 09:50Z
    NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
    cvelistv5