CVE-2026-27156
NiceGUI is a Python-based UI framework.
Published Feb 24, 2026 · updated Jun 17, 2026 · zauberzeug nicegui
NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements ( , , , and others) use an fallback in the JavaScript-side function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser. Additionally, and used string interpolation instead of for the method/property name, allowing quote injection to break out of the intended string context. Version 3.8.0 contains a fix.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 24, 2026 · NIST NVD
Detected
NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements ( , , , and others) use an fallback in the JavaScript-side function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser. Additionally, and used string interpolation instead of for th
Jun 17, 2026 · NIST NVD
Updated
NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements ( , , , and others) use an fallback in the JavaScript-side function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser. Additionally, and used string interpolation instead of for th
Affected
- cpe zauberzeug/niceguiversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-27156
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-27156
NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements ( , , , and others) use an fallback in the JavaScript-side `runMeth
nvd.nist.gov