LiveActive security incident?Get immediate response
CVE Record

CVE-2026-27156: NiceGUI has XSS via Code Injection

NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements (`Element.run_method()`, `AgGrid.run_grid_method()`, `EChart.run_chart_method()`, and others) use an `eval()` fallback in the JavaScript-side `runMethod()` function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser. Additionally, `Element.run_method()` and `Element.get_computed_prop()` used string interpolation instead of `json.dumps()` for the method/property name, allowing quote injection to break out of the intended string context. Version 3.8.0 contains a fix.

MediumCVSS 6.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

NiceGUI applications before 3.8.0 can allow browser-side script injection if user-controlled input reaches certain client method APIs. This is a cross-site scripting issue requiring user interaction, but it can expose user data or alter page behavior in the victim’s browser.

Executive priority

Treat as a timely application dependency update, not an emergency based on current evidence. Prioritize internet-facing or multi-user NiceGUI applications where untrusted users can influence UI behavior.

Technical view

The issue affects zauberzeug NiceGUI versions before 3.8.0. APIs including Element.run_method(), AgGrid.run_grid_method(), EChart.run_chart_method(), and related client-side method execution used an eval() fallback or unsafe string interpolation, allowing attacker-controlled method or property names to break context and execute JavaScript. CVSS is 6.1, CWE-79.

Likely exposure

Exposure is likely in applications using NiceGUI below 3.8.0, especially where route parameters, form fields, database values, or other user-controlled data are passed into affected method or property-name APIs.

Exploitation context

Sources do not indicate active exploitation, and the CVE is not listed as KEV in the provided data. Exploitation requires a victim to interact with affected application content or workflow where attacker-controlled input reaches the vulnerable API path.

Researcher notes

Key review areas are NiceGUI server-to-client APIs that serialize method or property names into JavaScript. The fix is documented in the upstream advisory and commit. Evidence is limited to the provided CVE, GitHub advisory, and patch reference.

Mitigation direction

  • Upgrade NiceGUI to version 3.8.0 or later.
  • Review vendor advisory and commit for exact fixed behavior.
  • Avoid passing user-controlled input as client method or property names.
  • Sanitize or allowlist dynamic method/property names where unavoidable.

Validation and detection

  • Inventory applications and dependencies using NiceGUI.
  • Confirm installed NiceGUI versions are 3.8.0 or later.
  • Search code for affected APIs named in the advisory.
  • Trace whether user-controlled input reaches method or property-name arguments.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-27156 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.1CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N2.82.7Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.1Medium
CVSS 3.1 vector shape for CVE-2026-27156Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
zauberzeugnicegui< 3.8.0Listed
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.