NiceGUI versions 2.13.0 through 3.4.1 allow arbitrary JavaScript to be executed in a victim's browser if an attacker controls the string passed to ui.navigate.history.push() or ui.navigate.history.replace(). The framework generates JavaScript that embeds the supplied URL without proper escaping, enabling a crafted payload to break out of the intended string context. This flaw therefore enables cross‑site scripting attacks that could result in session hijacking, data theft, or malicious script execution on the client side.

The affected product is NiceGUI, a Python‑based UI framework developed by zauberzeug. Versions from 2.13.0 up to and including 3.4.1 contain the flaw; these installations are vulnerable when untrusted input is passed to the navigation APIs. A fix is available in version 3.5.0 released by the vendor.

The vulnerability carries a CVSS base score of 6.1 and an EPSS score of less than 1 %, indicating a moderate severity and a very low current exploitation probability. The flaw is not listed in the CISA KEV catalog. Exploitation requires the web application to forward attacker‑controlled input to the navigation helpers; if the application never does so, the risk is effectively mitigated. The likely attack vector is client‑side through the browser, triggered by an attacker‑crafted URL that the application injects into the JavaScript context.