CVE-2026-21872

NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the click event listener used by ui.subpages, combined with attacker-controlled link rendering on the page, causes XSS when the user actively clicks on the link. This issue has been patched in versi...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +32 more potentially affected by CVE-2026-21872 via nicegui (>=2.22.2, <=3.3.1)

nicegui PYPI version =2.22.2, =0.0.1, =0.2.200, =0.3.0, =0.1.3, =0.8.0, =1.11.0b1, =0.13.24, =0.4.24, =0.2.14, =0.30.0, =0.30.8 and more Source cves: CVE-2026-21872 Source advisory: MEND:CVE-2026-21872...