A high-severity cross-site scripting vulnerability in the NiceGUI framework enables remote attackers to execute arbitrary scripts in the context of a user session.

This is a cross-site scripting (CWE-79) vulnerability originating from an unsafe pushstate event listener in the ui.sub_pages component. An unauthenticated attacker can exploit this by manipulating URL fragment identifiers, typically delivered via an iframe, to execute malicious code.

The vulnerability carries a CVSS score of 7.2, reflecting its potential for unauthorized script execution. Successful exploitation could lead to session hijacking, unauthorized actions performed on behalf of legitimate users, or the theft of sensitive information processed within the application. Given the framework's role in UI generation, this flaw poses a significant risk to the integrity and confidentiality of user interactions.

Immediate Action: Update the NiceGUI package to version 3.5.0 or later to apply the official security fix provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous URL parameters or unusual iframe-based traffic patterns that may indicate attempts to inject malicious fragments.

Compensating Controls: Implement a robust Content Security Policy (CSP) to restrict the execution of unauthorized scripts and prevent the loading of malicious iframes from untrusted origins.

Public Exploit Available: Unknown.

Due to the high severity of this cross-site scripting flaw and the availability of a proof-of-concept, immediate action is required. Organizations utilizing NiceGUI must prioritize upgrading to version 3.5.0 to neutralize the risk of unauthorized code execution. Failure to patch may expose users to session-based attacks and data compromise.