A vulnerability was detected in a2ui-project a2ui up to 0.10.6. (CVE-2026-92213)
A vulnerability in a2ui-project a2ui up to version 0.10.6 allows remote injection via manipulation of the primaryColor argument in the Angular Renderer component's z.any function. This issue affects the file renderers/web_core/src/v0_9/schema/server-to-client.ts and has a medium severity rating. A patch identified by commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b is available to address this vulnerability.
AI Analysis
Technical Summary
The vulnerability exists in the a2ui-project a2ui software up to version 0.10.6, specifically in the Angular Renderer component within the z.any function of the file renderers/web_core/src/v0_9/schema/server-to-client.ts. Manipulating the argument primaryColor can lead to injection attacks remotely. The vulnerability is tracked as CVE-2026-92213 with a CVSS 3.1 score of 5.5 (medium severity). A patch identified by commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b is suggested to remediate the issue.
Potential Impact
The vulnerability allows an attacker with low privileges and requiring user interaction to perform injection attacks remotely, potentially impacting confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. No known exploits in the wild have been reported.
Mitigation Recommendations
A patch identified by commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b is available and should be applied to affected versions up to 0.10.6 to remediate this vulnerability.
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. (CVE-2026-92213)
Description
A vulnerability in a2ui-project a2ui up to version 0.10.6 allows remote injection via manipulation of the primaryColor argument in the Angular Renderer component's z.any function. This issue affects the file renderers/web_core/src/v0_9/schema/server-to-client.ts and has a medium severity rating. A patch identified by commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b is available to address this vulnerability.
CVSS v3.1
Score 5.5medium
Affected software
pkg:github/a2ui-project/a2uiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the a2ui-project a2ui software up to version 0.10.6, specifically in the Angular Renderer component within the z.any function of the file renderers/web_core/src/v0_9/schema/server-to-client.ts. Manipulating the argument primaryColor can lead to injection attacks remotely. The vulnerability is tracked as CVE-2026-92213 with a CVSS 3.1 score of 5.5 (medium severity). A patch identified by commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b is suggested to remediate the issue.
Potential Impact
The vulnerability allows an attacker with low privileges and requiring user interaction to perform injection attacks remotely, potentially impacting confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. No known exploits in the wild have been reported.
Mitigation Recommendations
A patch identified by commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b is available and should be applied to affected versions up to 0.10.6 to remediate this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9j57-x538-48q4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-92213"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aaa2c3155bf5e2cf5101b94
Added to database: 09/16/2026, 05:42:09 UTC
Last enriched: 09/16/2026, 05:46:38 UTC
Last updated: 09/16/2026, 06:01:25 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.