CVE-2026-27156: NiceGUI XSS Vulnerability via Code Injection in Client-Side Element Functions
Summary
CVE-2026-27156: NiceGUI vulnerable to XSS via Code Injection during client-side element function execution. Affects nicegui versions < 3.8.0. Fixed in 3.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NiceGUI is a Python library designed for building interactive web applications with ease. It provides a set of APIs for managing client-side elements, allowing developers to create dynamic user interfaces. However, certain methods in NiceGUI are vulnerable to cross-site scripting (XSS) attacks due to improper handling of user input, which can lead to serious security issues.
Vulnerability Detail
The vulnerability arises from several NiceGUI APIs that execute methods on client-side elements using an eval() fallback in the JavaScript runMethod() function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser. This can lead to cookie or token theft, DOM manipulation, and actions performed as the victim user. Specifically, methods like Element.run_method() and Element.get_computed_prop() use string interpolation instead of proper escaping, allowing for quote injection and breaking out of the intended string context.
How To Fix
Latest published version: 3.18.0 as of 22 Oct 2026
pip install --upgrade "nicegui==3.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.8.0
This is the first release that contains the fix.
pip install --upgrade "nicegui==3.8.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, you can modify your code to avoid passing user-controlled input directly to the affected methods. Instead of using run_method() with a user-provided method name, use the ui.run_javascript() method. For example, replace: element.run_method(user_provided_method_name) with: row = await ui.run_javascript(f'return getElement({grid.id}).api.getDisplayedRowAtIndex(0).data')
Conclusion
The NiceGUI library has a significant vulnerability that can lead to XSS attacks through improper handling of user input in client-side methods. It is crucial for developers using NiceGUI to update to the latest version to mitigate this risk and to implement workarounds if immediate updates are not feasible.
See every vulnerability recorded for nicegui →
FAQ
The vulnerability allows for cross-site scripting (XSS) through code injection in client-side element functions.
Attackers can steal cookies, manipulate the DOM, and perform actions as the victim user, leading to potential data breaches.
Versions of NiceGUI up to and including 3.7.1 are affected by this vulnerability.
You can use the Vulert playground to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nicegui.
