https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:04:19 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-265157 EUVD-2026-265157 https://cve.radiocsirt.org/vuln/euvd-2026-265157 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21873 <p>NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site, using an iframe. This issue has been patched in version 3.5.0.</p> <p>NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site, using an iframe. This issue has been patched in version 3.5.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-21873 https://cve.radiocsirt.org/vuln/ghsa-mhpg-c27v-6mxr <p><strong>Affected:</strong> PyPI: nicegui</p> <p>### Summary</p> <p>An unsafe implementation in the `pushstate` event listener used by `ui.sub_pages` allows an attacker to manipulate the fragment identifier of the URL, which _they can do despite being cross-site, using an iframe_.</p> <p>### Details</p> <p>The problem is traced as follows:</p> <p>1. On `pushstate`, `handleStateEvent` is executed.</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/elements/sub_pages.js#L38-L39</p> <p>2. `handleStateEvent` emits `sub_pages_open` event.</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/elements/sub_pages.js#L22-L25</p> <p>3. `SubPagesRouter` (used by `ui.sub_pages`), lisnening on `sub_pages_open`, `_handle_open` runs.</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/sub_pages_router.py#L18-L22</p> <p>4. `_handle_open` finds any `SubPages` and runs `_show()` on them</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/sub_pages_router.py#L63-L71</p> <p>5. If the if-logic is followed or debug prints are added, it can be found that it calls `self._handle_scrolling(match, behavior=&#39;smooth&#39;)` directly</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/elements/sub_pages.py#L76-L100</p> <p>6. **CULPRIT** `_handle_scrolling` runs `_scroll_to_fragment` as there is a fragment, which runs vulnerable JS if the `fragment` (attacker-controlled) escapes out of the quotes.</p> <p>https:…</p> <p><strong>Affected:</strong> PyPI: nicegui</p> <p>### Summary</p> <p>An unsafe implementation in the `pushstate` event listener used by `ui.sub_pages` allows an attacker to manipulate the fragment identifier of the URL, which _they can do despite being cross-site, using an iframe_.</p> <p>### Details</p> <p>The problem is traced as follows:</p> <p>1. On `pushstate`, `handleStateEvent` is executed.</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/elements/sub_pages.js#L38-L39</p> <p>2. `handleStateEvent` emits `sub_pages_open` event.</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/elements/sub_pages.js#L22-L25</p> <p>3. `SubPagesRouter` (used by `ui.sub_pages`), lisnening on `sub_pages_open`, `_handle_open` runs.</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/sub_pages_router.py#L18-L22</p> <p>4. `_handle_open` finds any `SubPages` and runs `_show()` on them</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/sub_pages_router.py#L63-L71</p> <p>5. If the if-logic is followed or debug prints are added, it can be found that it calls `self._handle_scrolling(match, behavior=&#39;smooth&#39;)` directly</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/elements/sub_pages.py#L76-L100</p> <p>6. **CULPRIT** `_handle_scrolling` runs `_scroll_to_fragment` as there is a fragment, which runs vulnerable JS if the `fragment` (attacker-controlled) escapes out of the quotes.</p> <p>https:…</p> https://cve.radiocsirt.org/vuln/ghsa-mhpg-c27v-6mxr https://cve.radiocsirt.org/vuln/pysec-2026-1702 <p><strong>Affected:</strong> PyPI: nicegui</p> <p>### Summary</p> <p>An unsafe implementation in the `pushstate` event listener used by `ui.sub_pages` allows an attacker to manipulate the fragment identifier of the URL, which _they can do despite being cross-site, using an iframe_.</p> <p>### Details</p> <p>The problem is traced as follows:</p> <p>1. On `pushstate`, `handleStateEvent` is executed.</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/elements/sub_pages.js#L38-L39</p> <p>2. `handleStateEvent` emits `sub_pages_open` event.</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/elements/sub_pages.js#L22-L25</p> <p>3. `SubPagesRouter` (used by `ui.sub_pages`), lisnening on `sub_pages_open`, `_handle_open` runs.</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/sub_pages_router.py#L18-L22</p> <p>4. `_handle_open` finds any `SubPages` and runs `_show()` on them</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/sub_pages_router.py#L63-L71</p> <p>5. If the if-logic is followed or debug prints are added, it can be found that it calls `self._handle_scrolling(match, behavior=&#39;smooth&#39;)` directly</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/elements/sub_pages.py#L76-L100</p> <p>6. **CULPRIT** `_handle_scrolling` runs `_scroll_to_fragment` as there is a fragment, which runs vulnerable JS if the `fragment` (attacker-controlled) escapes out of the quotes.</p> <p>https:…</p> <p><strong>Affected:</strong> PyPI: nicegui</p> <p>### Summary</p> <p>An unsafe implementation in the `pushstate` event listener used by `ui.sub_pages` allows an attacker to manipulate the fragment identifier of the URL, which _they can do despite being cross-site, using an iframe_.</p> <p>### Details</p> <p>The problem is traced as follows:</p> <p>1. On `pushstate`, `handleStateEvent` is executed.</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/elements/sub_pages.js#L38-L39</p> <p>2. `handleStateEvent` emits `sub_pages_open` event.</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/elements/sub_pages.js#L22-L25</p> <p>3. `SubPagesRouter` (used by `ui.sub_pages`), lisnening on `sub_pages_open`, `_handle_open` runs.</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/sub_pages_router.py#L18-L22</p> <p>4. `_handle_open` finds any `SubPages` and runs `_show()` on them</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/sub_pages_router.py#L63-L71</p> <p>5. If the if-logic is followed or debug prints are added, it can be found that it calls `self._handle_scrolling(match, behavior=&#39;smooth&#39;)` directly</p> <p>https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/elements/sub_pages.py#L76-L100</p> <p>6. **CULPRIT** `_handle_scrolling` runs `_scroll_to_fragment` as there is a fragment, which runs vulnerable JS if the `fragment` (attacker-controlled) escapes out of the quotes.</p> <p>https:…</p> https://cve.radiocsirt.org/vuln/pysec-2026-1702