This vulnerability exists in the a2ui-project a2ui component up to version 0.10.6, specifically in the Angular Renderer function z.any. The flaw allows injection attacks via manipulation of the primaryColor argument, which can be exploited remotely. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. The vendor has released a patch (commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b) to remediate the issue.

Successful exploitation of this injection vulnerability could allow an attacker to inject malicious input remotely, potentially leading to partial compromise of the affected system's integrity or behavior. The CVSS vector indicates low attack complexity, no privileges required, but user interaction is needed, and the impact on confidentiality, integrity, and availability is low to limited.

Apply the official patch identified by commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b to affected versions 0.10.0 through 0.10.6 of a2ui-project a2ui. This patch addresses the injection vulnerability in the Angular Renderer component. No other mitigation steps are indicated by the vendor advisory.