CVE-2026-21873

HighPublic PoC

Published: 08 January 2026

Published

08 January 2026

Modified

15 January 2026

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Score 0.0002 5.9th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-21873 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Zauberzeug Nicegui. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190).

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing

addresses: CWE-79

Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.

SI-10 Information Input Validation

addresses: CWE-79

Validates web inputs to reject script-related content that could produce XSS.

SI-15 Information Output Filtering

addresses: CWE-79

Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Directly enables exploitation of a public-facing web UI via cross-origin iframe-based fragment manipulation (CWE-79).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site,…

using an iframe. This issue has been patched in version 3.5.0.

Deeper analysisAI

CVE-2026-21873 is a vulnerability in NiceGUI, a Python-based UI framework, affecting versions 2.22.0 through 3.4.1. The issue arises from an unsafe implementation in the pushstate event listener used by the ui.sub_pages feature, which permits manipulation of the URL fragment identifier even from a cross-site context via an iframe. Published on 2026-01-08, it has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and is classified under CWE-79.

An unauthenticated attacker with network access can exploit this vulnerability without requiring user interaction, as indicated by the low attack complexity and changed scope in the CVSS vector. By embedding the affected NiceGUI application in an iframe from a malicious site, the attacker can manipulate the URL fragment identifier cross-site, potentially leading to limited impacts on confidentiality and integrity, such as unauthorized access to or alteration of client-side state.

The vulnerability has been patched in NiceGUI version 3.5.0. Security advisories recommend updating to this version or later to mitigate the issue. Additional details are provided in the release notes at https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0 and the GitHub security advisory at https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mhpg-c27v-6mxr.