AIKIDO-2026-603313

TL;DR

ColorPicker.set_color(), also used internally by ui.color_input, inserts the supplied color value into a .props() declaration without escaping prop-syntax metacharacters. A value containing a double quote can terminate the intended model-value prop and inject an additional :-prefixed prop, which NiceGUI evaluates as a JavaScript expression outside the sanitizer path. An application that passes untrusted, stored, or cross-user color values to these APIs can therefore have arbitrary JavaScript run in a victim's session. The fix assigns the color value directly instead of routing it through the prop-string parser.