PT-2026-21771 · Unknown+5 · Leafletlayer+6
Anuraagbaishya
·
Published
2026-02-24
·
Updated
2026-02-25
·
CVE-2026-27156
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
NiceGUI versions prior to 3.8.0
Description
NiceGUI APIs, including
Element.run method(), AgGrid.run grid method(), EChart.run chart method(), and others, utilized an eval() fallback within the JavaScript-side runMethod() function. This allowed for arbitrary JavaScript execution in the victim’s browser when user-controlled input was provided as the method name. Additionally, Element.run method() and Element.get computed prop() used string interpolation instead of json.dumps() for method/property names, enabling quote injection to bypass intended string context. An attacker could craft a malicious URL with a payload as a query parameter and, if the application passes this parameter as a method name to any of the affected APIs, the payload is sent to the client via WebSocket and executed. This could lead to cookie/token theft, DOM manipulation, and actions performed as the victim user. The affected methods include: Element.run method(), Element.get computed prop(), AgGrid.run grid method(), AgGrid.run row method(), EChart.run chart method(), JsonEditor.run editor method(), Xterm.run terminal method(), Leaflet.run map method(), Leaflet.run layer method(), and LeafletLayer.run method().Recommendations
Update to NiceGUI version 3.8.0 or later.
If updating is not immediately possible, utilize
ui.run javascript() instead of passing JavaScript functions as method names. For example, replace row = await grid.run grid method('g => g.getDisplayedRowAtIndex(0).data') with row = await ui.run javascript(f'return getElement({grid.id}).api.getDisplayedRowAtIndex(0).data').Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ag-Grid
Echarts
Jsoneditor
Leaflet
Leafletlayer
Nicegui
Xterm