CVE-2026-27156: NiceGUI Arbitrary JavaScript Execution Vulnerability
Summary
CVE-2026-27156: NiceGUI is a Python-based UI framework. Affects nicegui versions < 3.8.0. Fixed in 3.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NiceGUI is a Python-based UI framework designed to facilitate the creation of user interfaces with ease. It provides a range of APIs for developers to interact with client-side elements, enabling dynamic web applications. However, prior to version 3.8.0, NiceGUI contained vulnerabilities that allowed for arbitrary JavaScript execution due to improper handling of user-controlled input.
Vulnerability Detail
The vulnerability arises from several NiceGUI APIs that utilize an 'eval()' fallback in the JavaScript-side 'runMethod()' function. When user-controlled input is passed as the method name, it allows an attacker to inject arbitrary JavaScript that executes in the victim's browser. Additionally, the use of string interpolation instead of 'json.dumps()' in 'Element.run_method()' and 'Element.get_computed_prop()' permits quote injection, enabling attackers to break out of the intended string context. This can lead to severe security implications, including unauthorized actions in the user's session.
How To Fix
Latest published version: 3.18.0 as of 22 Oct 2026
pip install --upgrade "nicegui==3.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.8.0
This is the first release that contains the fix.
pip install --upgrade "nicegui==3.8.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the vulnerable APIs that allow user-controlled input for method names until you can update to the patched version. Ensure that any user input is properly sanitized and validated before being processed.
Conclusion
In summary, the NiceGUI framework has a critical vulnerability that allows for arbitrary JavaScript execution due to improper handling of user input. It is crucial to update to version 3.8.0 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor your application for vulnerabilities effectively.
See every vulnerability recorded for nicegui →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a medium severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include arbitrary JavaScript execution in the victim's browser, which can lead to unauthorized actions and data breaches.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
If you cannot update immediately, ensure to sanitize and validate all user inputs and avoid using the vulnerable APIs until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for nicegui.
