Xx-Mikusan-Xx

**Name of the Vulnerable Software and Affected Versions** NiceGUI versions 2.13.0 through 3.4.1 **Description** NiceGUI is a Python-based UI framework susceptible to a cross-site scripting (XSS) issue. The issue arises when developers provide attacker-controlled strings to the `ui.navigate.history.push()` or `ui.navigate.history.replace()` functions. These functions, designed as History API wrappers for updating the browser URL without a page reload, can allow a crafted payload to execute arbitrary JavaScript in the victim’s browser if the URL argument is embedded into generated JavaScript without proper escaping. Applications that do not pass untrusted input into these functions are not affected. The functions `ui.navigate.history.push()` and `ui.navigate.history.replace()` are vulnerable. **Recommendations** NiceGUI versions 2.13.0 through 3.4.1 should be updated to version 3.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** NiceGUI versions 2.22.0 through 3.4.1 **Description** NiceGUI is a Python-based UI framework susceptible to a cross-site scripting (XSS) issue. The problem stems from an unsafe implementation within the click event listener used by `ui.sub pages`, coupled with the rendering of attacker-controlled links on the page. When a user clicks on such a link, XSS can occur. The issue involves the `ui.sub pages` function and the handling of links. **Recommendations** Upgrade to NiceGUI version 3.5.0 or later.