Threats affecting pkg:github/a2ui-project/a2ui

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.

CVE-2026-118537 is a medium severity vulnerability in the a2ui library up to version 0.10.4. It involves improper input validation in the Image component's handling of the 'url' argument, potentially allowing remote manipulation. A fix has been developed but is pending acceptance. No known exploits are reported in the wild.

CVE-2026-118276 is a medium severity vulnerability in the a2ui-project a2ui software up to version 0.10.6. It affects the formatString function in the Parser component, causing resource consumption when exploited remotely. Public exploit code is available. A patch identified by commit 1f71d1aac1b145ef57c7526f9e0cff316f5934e2 is recommended to fix the issue.

CVE-2026-118274 is a medium severity vulnerability in a2ui-project a2ui up to version 0.10.6. It affects an unknown functionality in the Binder component's generic-binder.ts file, leading to resource consumption. The vulnerability can be exploited remotely without user interaction. Public exploit details have been disclosed. A patch identified by commit c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e is recommended to fix the issue.

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as c76e17272e52c12c6dcf68905b1df978c39e9aa5. It is advisable to implement a patch to correct this issue.

CVE-2026-118273 is a medium severity vulnerability in a2ui-project's a2ui component up to version 0.10.6. The flaw exists in the DataModel.set function of the file renderers/web_core/src/v0_9/state/data-model.ts and can be exploited remotely to cause resource consumption. Exploit code has been published. A patch identified by commit 82789191ce551f4d7a095d273773fb24bd764c9d is available to remediate this issue.

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error message. It is possible to initiate the attack remotely. The exploit is now public and may be used. The patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01. It is suggested to install a patch to address this issue.

CVE-2026-118271 is a medium severity vulnerability in a2ui-project a2ui versions 0.10.0 through 0.10.6. It involves resource consumption caused by manipulation of an unknown function in the data-context Resolver component. The vulnerability can be exploited remotely without user interaction or privileges. Public exploit code has been disclosed. A patch identified by commit eb314e14fabd29cfb4a74e1202afc4fe2081efa2 is available to remediate the issue.

A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument current[segment] leads to information disclosure. The attack may be initiated remotely. The identifier of the patch is 1b3bff234661ce922cbc3771be642b23ec9fd0fa. To fix this issue, it is recommended to deploy a patch.

A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component Update Components. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability in a2ui-project a2ui up to version 0.10.6 allows remote injection via manipulation of the primaryColor argument in the Angular Renderer component's z.any function. This issue affects the file renderers/web_core/src/v0_9/schema/server-to-client.ts and has a medium severity rating. A patch identified by commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b is available to address this vulnerability.

CVE-2026-92216 is an open redirect vulnerability in the a2ui-project a2ui component affecting versions up to 0.10.7. The issue exists in the openUrl function of the Binder component, allowing remote attackers to manipulate URLs and redirect users to unintended locations. The vulnerability has a medium severity rating with a CVSS score of 4.3. The project has been informed but has not yet responded or issued a fix.

A vulnerability exists in a2ui-project a2ui up to version 0.10.6 affecting the processMessages function in the Message Parsing component. This flaw involves manipulation that causes dynamically-determined object attributes and can be exploited remotely. The project has been notified but has not yet responded or issued a fix. The vulnerability has a medium severity rating with a CVSS score of 6.3.

A server-side request forgery (SSRF) vulnerability exists in a2ui-project a2ui up to version 0.10.7. The flaw is in the httpx.get function within the FileResolver component, allowing remote attackers to initiate SSRF attacks. A patch has been identified to fix this issue.