CVE-2026-27156

NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements (`Element.run_method()`, `AgGrid.run_grid_method()`, `EChart.run_chart_method()`, and others) use an `eval()` fallback in the JavaScript-side `runMethod()` function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser. Additionally, `Element.run_method()` and `Element.get_computed_prop()` used string interpolation instead of `json.dumps()` for the method/property name, allowing quote injection to break out of the intended string context. Version 3.8.0 contains a fix.

• CWE-79

• https://github.com/zauberzeug/nicegui/commit/1861f59cc374ca0dc9d970b157ef3774720f8dbfPatch
• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-78qv-3mpx-9cqqMitigation, Vendor Advisory

Published

Feb 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27149Discourse is an open source discussion platform. Prior to ve…6.5
• CVE-2026-27150Discourse is an open source discussion platform. Prior to ve…3.8
• CVE-2026-27151Discourse is an open source discussion platform. Prior to ve…2.7
• CVE-2026-27152Discourse is an open source discussion platform. Prior to ve…3.8
• CVE-2026-27153Discourse is an open source discussion platform. Prior to ve…2.7
• CVE-2026-27154Discourse is an open source discussion platform. Prior to ve…6.1
• CVE-2026-2716The Client Testimonial Slider plugin for WordPress is vulner…4.4
• CVE-2026-27161GetSimple CMS is a content management system. All versions o…7.5
• CVE-2026-27162Discourse is an open source discussion platform. Prior to ve…4.9
• CVE-2026-27163Rejected reason: This CVE was assigned in error.
• CVE-2026-27166Discourse is an open source discussion platform. Prior to ve…5.4
• CVE-2026-27167Gradio is an open-source Python package designed for quick p…5.9