CVE-2026-92357: Information Disclosure in a2ui-project a2ui
CVE-2026-92357 is an information disclosure vulnerability in the a2ui-project a2ui versions 0.8, 0.9, and 1.0. The flaw exists in an unknown function within the model-processor.ts file of the Model Processor component. The vulnerability arises from manipulation of the argument current[segment], which can be exploited remotely to disclose information. A patch has been identified to fix this issue.
AI Analysis
Technical Summary
The vulnerability CVE-2026-92357 affects the a2ui-project a2ui software versions 0.8, 0.9, and 1.0. It involves an information disclosure flaw in an unspecified function of the model-processor.ts file within the Model Processor component. The issue is caused by manipulation of the argument current[segment], which can be triggered remotely without user interaction or elevated privileges. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). A patch identified by commit 1b3bff234661ce922cbc3771be642b23ec9fd0fa is recommended to remediate the issue.
Potential Impact
Successful exploitation of this vulnerability can lead to unauthorized information disclosure. The attack can be performed remotely and does not require user interaction or elevated privileges, but the impact is limited to information disclosure with low confidentiality impact according to the CVSS vector.
Mitigation Recommendations
A patch has been identified for this vulnerability (commit 1b3bff234661ce922cbc3771be642b23ec9fd0fa). It is recommended to deploy this patch to remediate the issue. No vendor advisory content is provided to confirm patch availability status, but the presence of a patch commit indicates an official fix is available.
CVE-2026-92357: Information Disclosure in a2ui-project a2ui
Description
CVE-2026-92357 is an information disclosure vulnerability in the a2ui-project a2ui versions 0.8, 0.9, and 1.0. The flaw exists in an unknown function within the model-processor.ts file of the Model Processor component. The vulnerability arises from manipulation of the argument current[segment], which can be exploited remotely to disclose information. A patch has been identified to fix this issue.
CVSS v4.0
Score 5.3medium
Affected software
a2ui-project
a2ui
pkg:github/a2ui-project/a2uicpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-92357 affects the a2ui-project a2ui software versions 0.8, 0.9, and 1.0. It involves an information disclosure flaw in an unspecified function of the model-processor.ts file within the Model Processor component. The issue is caused by manipulation of the argument current[segment], which can be triggered remotely without user interaction or elevated privileges. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). A patch identified by commit 1b3bff234661ce922cbc3771be642b23ec9fd0fa is recommended to remediate the issue.
Potential Impact
Successful exploitation of this vulnerability can lead to unauthorized information disclosure. The attack can be performed remotely and does not require user interaction or elevated privileges, but the impact is limited to information disclosure with low confidentiality impact according to the CVSS vector.
Mitigation Recommendations
A patch has been identified for this vulnerability (commit 1b3bff234661ce922cbc3771be642b23ec9fd0fa). It is recommended to deploy this patch to remediate the issue. No vendor advisory content is provided to confirm patch availability status, but the presence of a patch commit indicates an official fix is available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-16T05:19:44.490Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aab140955bf5e2cf5388c69
Added to database: 09/16/2026, 22:11:21 UTC
Last enriched: 09/16/2026, 22:12:38 UTC
Last updated: 09/16/2026, 23:00:10 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.