JavaScript Injection Vulnerability in NiceGUI Python Framework
CVE-2026-27156

6.1MEDIUM

Key Information:

Vendor

Zauberzeug

Status
Nicegui
Vendor
CVE Published:
24 February 2026

What is CVE-2026-27156?

NiceGUI, a Python-based UI framework, contains a vulnerability in multiple APIs that execute methods on client-side elements. Specifically, the Element.run_method(), AgGrid.run_grid_method(), EChart.run_chart_method(), and others leverage an insecure eval() function fallback, which allows attackers to manipulate user-controlled input for method names. This enables arbitrary JavaScript injection, potentially affecting users' browsers. Furthermore, the misuse of string interpolation in functions like Element.run_method() and Element.get_computed_prop() could allow quote injection, leading to unintended code execution. Users are encouraged to upgrade to version 3.8.0, which addresses these security flaws.

Affected Version(s)

nicegui < 3.8.0

References

https://github.com/zauberzeug/nicegui/security/advisories...
x_refsource_CONFIRM
https://github.com/zauberzeug/nicegui/commit/1861f59cc374...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.