6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27156

CVE-2026-27156: NiceGUI vulnerable to XSS via Code Injection during client-side element function execution

Summary

Several NiceGUI APIs that execute methods on client-side elements (Element.run_method(), AgGrid.run_grid_method(), EChart.run_chart_method(), and others) use an eval() fallback in the JavaScript-side runMethod() function. When user-controlled input is passed as the method name, an attacker can inject arbitrary JavaScript that executes in the victim's browser.

Additionally, Element.run_method() and Element.get_computed_prop() used string interpolation instead of json.dumps() for the method/property name, allowing quote injection to break out of the intended string context.

Attack Vector

An attacker crafts a malicious URL with a payload as a query parameter. If the application passes this parameter as a method name to any of the affected APIs, the payload is sent to the client via WebSocket and executed via eval().

Example: /?method=alert(document.cookie) combined with application code like:

element.run_method(user_provided_method_name)

Impact

Cookie/token theft
DOM manipulation (phishing, fake login forms)
Actions performed as the victim user

Affected Methods

Element.run_method()
Element.get_computed_prop()
AgGrid.run_grid_method()
AgGrid.run_row_method()
EChart.run_chart_method()
JsonEditor.run_editor_method()
Xterm.run_terminal_method()
Leaflet.run_map_method()
Leaflet.run_layer_method()
LeafletLayer.run_method()

Fix

Miggo Vulnerability Database

→

CVE-2026-27156

CVE-2026-27156:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nicegui	pip	<= 3.7.1	3.8.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Cross-Site Scripting (XSS) issue caused by two compounding factors. First, multiple Python methods in the NiceGUI library, such as Element.run_method and Element.get_computed_prop, constructed JavaScript code using unsafe string interpolation. User-provided input intended to be a method or property name was not properly escaped, allowing an attacker to inject arbitrary JavaScript. Second, the corresponding client-side JavaScript function, runMethod, had a dangerous fallback mechanism. If a requested method name was not found on an element, it would use eval() to execute the provided string. This combination meant that any malicious JavaScript injected via the Python methods would be executed in the victim's browser. The patch addresses both problems: it enforces proper escaping on the server-side using json.dumps() and completely removes the eval() fallback from the client-side JavaScript.

Vulnerable functions

Element.run_method

nicegui/element.py

The 'name' parameter, which represents a JavaScript method name, was directly embedded into a JavaScript string using an f-string. This lack of escaping allowed an attacker to inject arbitrary characters, including quotes, to break out of the string and execute arbitrary JavaScript. The vulnerability is triggered when this crafted string is sent to the client and processed by the 'runMethod' JavaScript function, which contained an 'eval' fallback.

Element.get_computed_prop

nicegui/element.py

The 'prop_name' parameter was directly embedded into a JavaScript string using an f-string without proper escaping. This allowed an attacker to inject malicious JavaScript code by crafting a special property name, leading to a Cross-Site Scripting (XSS) vulnerability.

runMethod

nicegui/static/nicegui.js

This client-side JavaScript function contained a fallback mechanism that used 'eval()' to execute the 'method_name' parameter if the method was not found on the target element. This is the sink for the vulnerability, as it directly executed unsanitized input received from the server-side Python methods.

AgGrid.run_grid_method

nicegui/elements/aggrid.py

This function is listed in the security advisory as being affected. It likely uses the vulnerable 'Element.run_method' internally to execute methods on the client-side AgGrid component, making it an entry point for the XSS vulnerability.

AgGrid.run_row_method

nicegui/elements/aggrid.py

This function is listed in the security advisory as being affected. It likely uses the vulnerable 'Element.run_method' internally to execute methods on a specific row of the client-side AgGrid component, making it an entry point for the XSS vulnerability.

EChart.run_chart_method

nicegui/elements/echart.py

This function is listed in the security advisory as being affected. It likely uses the vulnerable 'Element.run_method' internally to execute methods on the client-side EChart component, making it an entry point for the XSS vulnerability.

JsonEditor.run_editor_method

nicegui/elements/json_editor.py

This function is listed in the security advisory as being affected. It likely uses the vulnerable 'Element.run_method' internally to execute methods on the client-side JsonEditor component, making it an entry point for the XSS vulnerability.

Xterm.run_terminal_method

nicegui/elements/xterm.py

This function is listed in the security advisory as being affected. It likely uses the vulnerable 'Element.run_method' internally to execute methods on the client-side Xterm component, making it an entry point for the XSS vulnerability.

Leaflet.run_map_method

nicegui/elements/leaflet.py

This function is listed in the security advisory as being affected. It likely uses the vulnerable 'Element.run_method' internally to execute methods on the client-side Leaflet map component, making it an entry point for the XSS vulnerability.

Leaflet.run_layer_method

nicegui/elements/leaflet.py

This function is listed in the security advisory as being affected. It likely uses the vulnerable 'Element.run_method' internally to execute methods on a layer of the client-side Leaflet map, making it an entry point for the XSS vulnerability.

LeafletLayer.run_method

nicegui/elements/leaflet.py

This function is listed in the security advisory as being affected. It likely uses the vulnerable 'Element.run_method' internally to execute methods on a client-side Leaflet layer, making it an entry point for the XSS vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.