4.3
MediumCVSS 3.1 · from VulDB
CVE-2026-118273
a2ui-project a2ui data-model.ts DataModel.set resource consumption
a2ui · Uncontrolled resource use · CWE-400Affecteda2ui
FixA patch is linked in the references.
PublishedOct 28, 02:30 · VulDB
ScoredOct 28 · 4.3 · VulDB
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/web_core/src/v0_9/state/data-model.ts. Executing a manipulation can lead to resource consumption. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called 82789191ce551f4d7a095d273773fb24bd764c9d. A patch should be applied to remediate this issue.
From VulDB
Affected and fixed versions
ProductAffectedFixed ina2ui0.10.0–a2ui0.10.1–a2ui0.10.2–a2ui0.10.3–a2ui0.10.4–a2ui0.10.5–a2ui0.10.6–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known