NiceGUI, a Python‑based UI framework, has a flaw in several client‑side APIs that execute element methods. Before version 3.8.0, these APIs use an JavaScript eval fallback and interpolate user‑supplied method names directly into strings. An attacker can supply arbitrary JavaScript as the method name, causing it to run in the victim’s browser. This cross‑site scripting flaw allows an attacker to execute any script in the context of the affected webpage, potentially compromising confidential data, hijacking sessions, and performing unauthorized actions on behalf of the user.

All versions of Zauberzeug NiceGUI prior to 3.8.0 are vulnerable. The issue exists in Element.run_method(), AgGrid.run_grid_method(), EChart.run_chart_method(), Element.get_computed_prop(), and related APIs.

The CVSS score of 6.1 indicates moderate severity, but EPSS is below 1 %, marking a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred from the description: an attacker must supply malicious input to one of the vulnerable APIs, which in turn renders the input as executable JavaScript in the client. The attacker needs the victim to load the page or submit data that contains the crafted method name, so risk is moderate but the exploitation likelihood is low.