NiceGUI, a Python UI framework, contains an unsafe pushstate event listener used by ui.sub_pages. The listener incorrectly handles changes to the fragment identifier of the URL. An attacker can exploit this flaw by loading the application in a cross‑site iframe and manipulating the fragment without user interaction. The result is a zero‑click XSS vulnerability that can inject arbitrary script into the victim’s browser, enabling session hijacking, credential theft, or defacement of the application.

Applications built with Zauberzeug NiceGUI versions from 2.22.0 up to 3.4.1 that use ui.sub_pages are affected. All such deployments are vulnerable regardless of the host or domain, as the flaw resides in the framework’s client‑side code.

The CVSS score of 7.2 indicates moderate‑to‑high severity. The EPSS score is below 1%, suggesting a low likelihood of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw can be triggered without any user interaction from a cross‑site iframe, it is effectively zero‑click and can be executed by remote attackers who control a malicious site. The patch was released in NiceGUI 3.5.0; lacking the fix an attacker can simply craft a malicious page that embeds the target application and sets the fragment identifier to trigger script injection.