{"cve":"CVE-2026-27156","nvd":{"published":"2026-02-24T18:29:33.490","modified":"2026-06-17T10:26:46.437","status":"Analyzed","description":"NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements (`Element.run_method()`, `AgGrid.run_grid_method()`, `EChart.run_chart_method()`, and others) use an `eval()` fallback in the JavaScript-side `runMethod()` function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser. Additionally, `Element.run_method()` and `Element.get_computed_prop()` used string interpolation instead of `json.dumps()` for the method/property name, allowing quote injection to break out of the intended string context. Version 3.8.0 contains a fix.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://github.com/zauberzeug/nicegui/commit/1861f59cc374ca0dc9d970b157ef3774720f8dbf","https://github.com/zauberzeug/nicegui/security/advisories/GHSA-78qv-3mpx-9cqq"],"products":["zauberzeug:nicegui"],"source":"nvd","synced_at":"2026-10-19T22:24:17.937441719+00:00"},"epss":{"cve":"CVE-2026-27156","score":0.00196,"percentile":0.09394,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-78qv-3mpx-9cqq","url":"https://osv.dev/vulnerability/GHSA-78qv-3mpx-9cqq","summary":"NiceGUI vulnerable to XSS via Code Injection during client-side element function execution","modified":"2026-07-13T07:26:13.919508653Z","packages":[{"ecosystem":"PyPI","name":"nicegui","purl":"pkg:pypi/nicegui","ranges":["<3.8.0"],"fixed":["3.8.0"]}]},{"id":"PYSEC-2026-2232","url":"https://osv.dev/vulnerability/PYSEC-2026-2232","summary":"","modified":"2026-07-13T07:15:38.556231969Z","packages":[{"ecosystem":"PyPI","name":"nicegui","purl":"pkg:pypi/nicegui","ranges":["<3.8.0"],"fixed":["3.8.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}