CVE-2026-21873

NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.subpages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site, using an iframe. This issue has been...

GHSA-MP55-G7PJ-RVM2 NiceGUI has Redis connection leak via tab storage causes service degradation

Summary An unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connections are never released, leading to service degradation when Redis hits its connection limit. NiceGUI continues accepting...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +35 more potentially affected by CVE-2026-21874 via nicegui (>=2.11.0, <=3.3.1)

nicegui PYPI version =2.11.0, =0.0.1, =0.2.200, =0.3.0, =0.1.3, =0.8.0, =0.10.0, =1.11.0b1, =0.13.24, =0.4.24, =0.2.14, =0.2.24 and more Source cves: CVE-2026-21874 Source advisory: GHSA-MP55-G7PJ-RVM2...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +35 more potentially affected by CVE-2026-21874 via nicegui (>=2.11.0, <=3.3.1)

nicegui PYPI version =2.11.0, =0.0.1, =0.2.200, =0.3.0, =0.1.3, =0.8.0, =0.10.0, =1.11.0b1, =0.13.24, =0.4.24, =0.2.14, =0.2.24 and more Source cves: CVE-2026-21874 Source advisory: SNYK:PYTHON-NICEGUI-14912449...

Missing Release of Resource after Effective Lifetime

Overview nicegui is a Create web-based user interfaces with Python. The nice way. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the handledisconnect function, when using the Redis backend for tab storage. An attacker can cause service...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +35 more potentially affected by CVE-2026-21874 via nicegui (>=2.11.0, <=3.3.1)

nicegui PYPI version =2.11.0, =0.0.1, =0.2.200, =0.3.0, =0.1.3, =0.8.0, =0.10.0, =1.11.0b1, =0.13.24, =0.4.24, =0.2.14, =0.2.24 and more Source cves: CVE-2026-21874 Source advisory: OSV:GHSA-MP55-G7PJ-RVM2...

NiceGUI has Redis connection leak via tab storage causes service degradation

Summary An unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connections are never released, leading to service degradation when Redis hits its connection limit. NiceGUI continues accepting...

GHSA-MHPG-C27V-6MXR NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS

Summary An unsafe implementation in the pushstate event listener used by ui.subpages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site, using an iframe. Details The problem is traced as follows: 1. On pushstate, handleStateEvent is...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +32 more potentially affected by CVE-2026-21873 via nicegui (>=2.22.2, <=3.3.1)

nicegui PYPI version =2.22.2, =0.0.1, =0.2.200, =0.3.0, =0.1.3, =0.8.0, =1.11.0b1, =0.13.24, =0.4.24, =0.2.14, =0.30.0, =0.30.8 and more Source cves: CVE-2026-21873 Source advisory: SNYK:PYTHON-NICEGUI-14912444...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +32 more potentially affected by CVE-2026-21873 via nicegui (>=2.22.2, <=3.3.1)

nicegui PYPI version =2.22.2, =0.0.1, =0.2.200, =0.3.0, =0.1.3, =0.8.0, =1.11.0b1, =0.13.24, =0.4.24, =0.2.14, =0.30.0, =0.30.8 and more Source cves: CVE-2026-21873 Source advisory: OSV:GHSA-MHPG-C27V-6MXR...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +32 more potentially affected by CVE-2026-21873 via nicegui (>=2.22.2, <=3.3.1)

nicegui PYPI version =2.22.2, =0.0.1, =0.2.200, =0.3.0, =0.1.3, =0.8.0, =1.11.0b1, =0.13.24, =0.4.24, =0.2.14, =0.30.0, =0.30.8 and more Source cves: CVE-2026-21873 Source advisory: GHSA-MHPG-C27V-6MXR...

NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS

Summary An unsafe implementation in the pushstate event listener used by ui.subpages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site, using an iframe. Details The problem is traced as follows: 1. On pushstate, handleStateEvent is...

Cross-site Scripting (XSS)

Overview nicegui is a Create web-based user interfaces with Python. The nice way. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ui.subpages function. An attacker can execute JavaScript in the context of the user's browser by tricking a user into clicking a...

NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

Summary An unsafe implementation in the click event listener used by ui.subpages, combined with attacker-controlled link rendering on the page, causes an XSS when the user actively clicks on the link. Details 1. On click, eventually subpagesnavigate event is emitted...

GHSA-M7J5-RQ9J-6JJ9 NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

Summary An unsafe implementation in the click event listener used by ui.subpages, combined with attacker-controlled link rendering on the page, causes an XSS when the user actively clicks on the link. Details 1. On click, eventually subpagesnavigate event is emitted...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +32 more potentially affected by CVE-2026-21872 via nicegui (>=2.22.2, <=3.3.1)

nicegui PYPI version =2.22.2, =0.0.1, =0.2.200, =0.3.0, =0.1.3, =0.8.0, =1.11.0b1, =0.13.24, =0.4.24, =0.2.14, =0.30.0, =0.30.8 and more Source cves: CVE-2026-21872 Source advisory: GHSA-M7J5-RQ9J-6JJ9...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +32 more potentially affected by CVE-2026-21872 via nicegui (>=2.22.2, <=3.3.1)

nicegui PYPI version =2.22.2, =0.0.1, =0.2.200, =0.3.0, =0.1.3, =0.8.0, =1.11.0b1, =0.13.24, =0.4.24, =0.2.14, =0.30.0, =0.30.8 and more Source cves: CVE-2026-21872 Source advisory: OSV:GHSA-M7J5-RQ9J-6JJ9...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +32 more potentially affected by CVE-2026-21872 via nicegui (>=2.22.2, <=3.3.1)

nicegui PYPI version =2.22.2, =0.0.1, =0.2.200, =0.3.0, =0.1.3, =0.8.0, =1.11.0b1, =0.13.24, =0.4.24, =0.2.14, =0.30.0, =0.30.8 and more Source cves: CVE-2026-21872 Source advisory: SNYK:PYTHON-NICEGUI-14912452...

Cross-site Scripting (XSS)

Overview nicegui is a Create web-based user interfaces with Python. The nice way. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ui.navigate.history.push or ui.navigate.history.replace functions. An attacker can execute arbitrary JavaScript in the victim's...

GHSA-7GRM-H62G-5M97 NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

Summary XSS risk exists in NiceGUI when developers pass attacker-controlled strings into ui.navigate.history.push or ui.navigate.history.replace. These helpers are documented as History API wrappers for updating the browser URL without page reload. However, if the URL argument is embedded into...