nice-gui-utils (0.1.6) potentially affected by CVE-2026-27156 via nicegui (1.4.3)

nicegui PYPI version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - nice-gui-utils 0.1.6 Source cves: CVE-2026-27156 Source advisory: OSV:PYSEC-2026-2232...

openorchestrator (>=1.1.0, <=1.3.1) potentially affected by CVE-2026-27156 via nicegui (1.4.12)

nicegui PYPI version 1.4.12 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - openorchestrator =1.1.0, =1.3.1 Source cves: CVE-2026-27156 Source advisory: OSV:PYSEC-2026-2232...

kayalab (>=0.1.0, <=0.7.29) potentially affected by CVE-2026-27156 via nicegui (1.4.13)

nicegui PYPI version 1.4.13 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - kayalab =0.1.0, =0.7.29 Source cves: CVE-2026-27156 Source advisory: OSV:PYSEC-2026-2232...

kayalab (>=0.7.30, <=0.11.9) potentially affected by CVE-2026-27156 via nicegui (1.4.24)

nicegui PYPI version 1.4.24 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - kayalab =0.7.30, =0.11.9 Source cves: CVE-2026-27156 Source advisory: OSV:PYSEC-2026-2232...

finalynx (>=1.2.0, <=1.14.4) potentially affected by CVE-2026-27156 via nicegui (1.4.25)

nicegui PYPI version 1.4.25 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - finalynx =1.2.0, =1.14.4 Source cves: CVE-2026-27156 Source advisory: OSV:PYSEC-2026-2232...

synth-mapping-helper (>=1.4.8, <=1.5.0) potentially affected by CVE-2026-27156 via nicegui (1.4.36)

nicegui PYPI version 1.4.36 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.4.8, =1.5.0 Source cves: CVE-2026-27156 Source advisory: OSV:PYSEC-2026-2232...

air-link (>=0.0.0, <=0.2.1), broh5 (1.3.2) +16 more potentially affected by CVE-2026-27156 via nicegui (1.4.37)

nicegui PYPI version 1.4.37 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - air-link =0.0.0, =0.1.0, =1.1.3, =0.6.7, =1.0.0, =1.14.5, =0.0.2a5, =1.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves:...

CVE-2026-27156

NiceGUI (Python) before version 3.8.0 is vulnerable to XSS via code injection in client-side runMethod-related APIs (Element.run_method, AgGrid.run_grid_method, EChart.run_chart_method, etc.) due to eval fallback and unsafe string interpolation of method names. The issue allows attacker-controlle...

CVE-2026-27156 NiceGUI has XSS via Code Injection

NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements Element.runmethod, AgGrid.rungridmethod, EChart.runchartmethod, and others use an eval fallback in the JavaScript-side runMethod function. When user-controlled input i...

CVE-2026-27156 NiceGUI has XSS via Code Injection

NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements Element.runmethod, AgGrid.rungridmethod, EChart.runchartmethod, and others use an eval fallback in the JavaScript-side runMethod function. When user-controlled input i...

CVE-2026-27156 NiceGUI has XSS via Code Injection

NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements Element.runmethod, AgGrid.rungridmethod, EChart.runchartmethod, and others use an eval fallback in the JavaScript-side runMethod function. When user-controlled input i...

CVE-2026-27156

NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements Element.runmethod, AgGrid.rungridmethod, EChart.runchartmethod, and others use an eval fallback in the JavaScript-side runMethod function. When user-controlled input i...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +53 more potentially affected by CVE-2026-27156 via nicegui (>=0.5.9, <=3.7.1)

nicegui PYPI version =0.5.9, =0.0.1, =0.2.200, =0.0.0, =0.1.3, =0.1.0, =1.1.3, =0.6.7, =1.0.0, =1.2.0, =0.10.0, =0.13.4 and more Source cves: CVE-2026-27156 Source advisory: MEND:CVE-2026-27156...

NiceGUI cross-site scripting vulnerability

NiceGUI is an easy-to-use, Python-based UI framework developed under the open source license. Versions of NiceGUI prior to 3.8.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from the use of eval in multiple client APIs, and incorrect escaping of method names, which...

PT-2026-21771

Name of the Vulnerable Software and Affected Versions NiceGUI versions prior to 3.8.0 Description NiceGUI APIs, including Element.run method, AgGrid.run grid method, EChart.run chart method, and others, utilized an eval fallback within the JavaScript-side runMethod function. This allowed for...

CVE-2026-27156: Improper Neutralization of Input During Web Page Generation

NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements Element.runmethod, AgGrid.rungridmethod, EChart.runchartmethod, and others use an eval fallback in the JavaScript-side runMethod function. When user-controlled input i...

CVE-2026-25516

NiceGUI is a Python-based UI framework. The ui.markdown component uses the markdown2 library to convert markdown content to HTML, which is then rendered via innerHTML. By default, markdown2 allows raw HTML to pass through unchanged. This means that if an application renders user-controlled conten...

CVE-2026-25732

NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOADDIR / file.name. Malicious filenames containing ../ sequences allow attackers to...

rosys (0.4.9) potentially affected by CVE-2026-25732 via nicegui (0.6.9)

nicegui PYPI version 0.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.4.9 Source cves: CVE-2026-25732 Source advisory: OSV:PYSEC-2026-95...

rosys (>=0.4.10, <=0.4.12) potentially affected by CVE-2026-25516 via nicegui (0.6.10)

nicegui PYPI version 0.6.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.4.10, =0.4.12 Source cves: CVE-2026-25516 Source advisory: OSV:PYSEC-2026-2231...