Threats affecting pkg:npm/a2ui

A vulnerability in a2ui up to version 0.10.4 affects the Image component in the file src/v0_9/basic_catalog/components/Image.js. The flaw involves improper input validation of the url argument, which can be manipulated remotely. A fix has been proposed but is not yet accepted.

CVE-2026-118274 is a medium severity vulnerability in the a2ui-project a2ui component up to version 0.10.6. It affects an unknown functionality within the Binder component's generic-binder.ts file, leading to resource consumption. The vulnerability can be exploited remotely without user interaction and requires low privileges. A patch identified by commit c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e is available to fix the issue.

CVE-2026-92114 is a medium severity vulnerability in the a2ui-project a2ui software up to version 0.10.6. It involves inefficient regular expression complexity in an unspecified function within the Basic Catalog component. This flaw can be exploited remotely and may lead to performance degradation or denial of service conditions due to excessive resource consumption during regex processing.