CVE-2026-21873
Published: 08 January 2026
Summary
CVE-2026-21873 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Zauberzeug Nicegui. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 0.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-21873 is a vulnerability in NiceGUI, a Python-based UI framework, affecting versions 2.22.0 through 3.4.1. The issue arises from an unsafe implementation in the pushstate event listener used by the ui.sub_pages feature, which permits manipulation of the URL fragment identifier even from a cross-site context via an iframe. Published on 2026-01-08, it has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and is classified under CWE-79.
An unauthenticated attacker with network access can exploit this vulnerability without requiring user interaction, as indicated by the low attack complexity and changed scope in the CVSS vector. By embedding the affected NiceGUI application in an iframe from a malicious site, the attacker can manipulate the URL fragment identifier cross-site, potentially leading to limited impacts on confidentiality and integrity, such as unauthorized access to or alteration of client-side state.
The vulnerability has been patched in NiceGUI version 3.5.0. Security advisories recommend updating to this version or later to mitigate the issue. Additional details are provided in the release notes at https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0 and the GitHub security advisory at https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mhpg-c27v-6mxr.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1475
Vulnerability details
NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site,…
more
using an iframe. This issue has been patched in version 3.5.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables exploitation of a public-facing web UI via cross-origin iframe-based fragment manipulation (CWE-79).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the vendor patch that eliminates the unsafe pushState listener in ui.sub_pages.
Requires validation and sanitization of URL fragment input received by the client-side event listener, blocking the cross-origin manipulation.
Enforces information-flow rules that can restrict cross-origin iframe access to the application's history API and fragment identifier.