CVE-2026-27156

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27156", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-18T00:18:53.962Z", "datePublished": "2026-02-24T17:00:21.628Z", "dateUpdated": "2026-02-26T21:33:40.507Z"}, "containers": {"cna": {"title": "NiceGUI has XSS via Code Injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/zauberzeug/nicegui/security/advisories/GHSA-78qv-3mpx-9cqq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zauberzeug/nicegui/security/advisories/GHSA-78qv-3mpx-9cqq"}, {"name": "https://github.com/zauberzeug/nicegui/commit/1861f59cc374ca0dc9d970b157ef3774720f8dbf", "tags": ["x_refsource_MISC"], "url": "https://github.com/zauberzeug/nicegui/commit/1861f59cc374ca0dc9d970b157ef3774720f8dbf"}], "affected": [{"vendor": "zauberzeug", "product": "nicegui", "versions": [{"version": "< 3.8.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T17:00:21.628Z"}, "descriptions": [{"lang": "en", "value": "NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements (`Element.run_method()`, `AgGrid.run_grid_method()`, `EChart.run_chart_method()`, and others) use an `eval()` fallback in the JavaScript-side `runMethod()` function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser. Additionally, `Element.run_method()` and `Element.get_computed_prop()` used string interpolation instead of `json.dumps()` for the method/property name, allowing quote injection to break out of the intended string context. Version 3.8.0 contains a fix."}], "source": {"advisory": "GHSA-78qv-3mpx-9cqq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27156", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T21:06:43.447905Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T21:33:40.507Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27156", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T21:06:43.447905Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T21:06:45.535Z"}}], "cna": {"title": "NiceGUI has XSS via Code Injection", "source": {"advisory": "GHSA-78qv-3mpx-9cqq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "zauberzeug", "product": "nicegui", "versions": [{"status": "affected", "version": "< 3.8.0"}]}], "references": [{"url": "https://github.com/zauberzeug/nicegui/security/advisories/GHSA-78qv-3mpx-9cqq", "name": "https://github.com/zauberzeug/nicegui/security/advisories/GHSA-78qv-3mpx-9cqq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/zauberzeug/nicegui/commit/1861f59cc374ca0dc9d970b157ef3774720f8dbf", "name": "https://github.com/zauberzeug/nicegui/commit/1861f59cc374ca0dc9d970b157ef3774720f8dbf", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements (`Element.run_method()`, `AgGrid.run_grid_method()`, `EChart.run_chart_method()`, and others) use an `eval()` fallback in the JavaScript-side `runMethod()` function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser. Additionally, `Element.run_method()` and `Element.get_computed_prop()` used string interpolation instead of `json.dumps()` for the method/property name, allowing quote injection to break out of the intended string context. Version 3.8.0 contains a fix."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T17:00:21.628Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27156", "state": "PUBLISHED", "dateUpdated": "2026-02-26T21:33:40.507Z", "dateReserved": "2026-02-18T00:18:53.962Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-24T17:00:21.628Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nicegui", "vendor": "zauberzeug", "versions": [{"status": "affected", "version": "< 3.8.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zauberzeug:nicegui:*:*:*:*:*:*:*:*", "matchCriteriaId": "1FE39EE2-B868-4B38-8F63-309587634F75", "versionEndExcluding": "3.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements (`Element.run_method()`, `AgGrid.run_grid_method()`, `EChart.run_chart_method()`, and others) use an `eval()` fallback in the JavaScript-side `runMethod()` function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser. Additionally, `Element.run_method()` and `Element.get_computed_prop()` used string interpolation instead of `json.dumps()` for the method/property name, allowing quote injection to break out of the intended string context. Version 3.8.0 contains a fix."}, {"lang": "es", "value": "NiceGUI es un framework de Interfaz de Usuario basado en Python. Antes de la versi\u00f3n 3.8.0, varias APIs de NiceGUI que ejecutan m\u00e9todos en elementos del lado del cliente ('Element.run_method()', 'AgGrid.run_grid_method()', 'EChart.run_chart_method()' y otras) usan un mecanismo de reserva 'eval()' en la funci\u00f3n 'runMethod()' del lado de JavaScript. Cuando se pasa una entrada controlada por el usuario como nombre del m\u00e9todo, un atacante puede inyectar JavaScript arbitrario que se ejecuta en el navegador de la v\u00edctima. Adem\u00e1s, 'Element.run_method()' y 'Element.get_computed_prop()' usaban interpolaci\u00f3n de cadenas en lugar de 'json.dumps()' para el nombre del m\u00e9todo/propiedad, lo que permit\u00eda la inyecci\u00f3n de comillas para escapar del contexto de cadena previsto. La versi\u00f3n 3.8.0 contiene una correcci\u00f3n."}], "id": "CVE-2026-27156", "lastModified": "2026-06-17T10:26:46.437", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27156", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T21:06:43.447905Z", "version": "2.0.3"}}]}, "published": "2026-02-24T18:29:33.490", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/zauberzeug/nicegui/commit/1861f59cc374ca0dc9d970b157ef3774720f8dbf"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/zauberzeug/nicegui/security/advisories/GHSA-78qv-3mpx-9cqq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.8.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nicegui", "source": "cna", "vendor": "zauberzeug"}, "product": "nicegui", "vendor": "zauberzeug"}], "analysis": {"en": {"generated_at": "2026-04-17T15:42:26.520150+00:00", "value": {"mitigation_remediation": ["Update NiceGUI to version 3.8.0 or later to apply the vendor\u2019s fix.", "Restrict the use of Element.run_method, AgGrid.run_grid_method, EChart.run_chart_method, and Element.get_computed_prop to trusted, validated inputs only.", "Implement input validation or sanitization on method names to ensure only legitimate identifiers are accepted, mitigating the risk of code injection."], "summary": {"action": "Patch Now", "impact": "Client\u2011side code execution via XSS"}, "threat_synthesis": {"affected_systems": "All versions of Zauberzeug NiceGUI prior to 3.8.0 are vulnerable. The issue exists in Element.run_method(), AgGrid.run_grid_method(), EChart.run_chart_method(), Element.get_computed_prop(), and related APIs.", "description_and_impact": "NiceGUI, a Python\u2011based UI framework, has a flaw in several client\u2011side APIs that execute element methods. Before version 3.8.0, these APIs use an JavaScript eval fallback and interpolate user\u2011supplied method names directly into strings. An attacker can supply arbitrary JavaScript as the method name, causing it to run in the victim\u2019s browser. This cross\u2011site scripting flaw allows an attacker to execute any script in the context of the affected webpage, potentially compromising confidential data, hijacking sessions, and performing unauthorized actions on behalf of the user.", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity, but EPSS is below 1\u202f%, marking a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred from the description: an attacker must supply malicious input to one of the vulnerable APIs, which in turn renders the input as executable JavaScript in the client. The attacker needs the victim to load the page or submit data that contains the crafted method name, so risk is moderate but the exploitation likelihood is low."}}}}, "created": "2026-02-25T11:38:36.253872+00:00", "updated": "2026-04-17T15:45:15.907733+00:00", "vendors": ["zauberzeug", "zauberzeug$PRODUCT$nicegui"]}