5.5
MediumCVSS 3.1 · from VulDB
CVE-2026-118538
a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes
a2ui · CWE-915 · CWE-915Affecteda2ui
FixA patch is linked in the references.
PublishedOct 28, 22:00 · VulDB
ScoredOct 28 · 5.5 · VulDB
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.
From VulDB
Affected and fixed versions
ProductAffectedFixed ina2ui0.1–a2ui0.2–a2ui0.3–a2ui0.4–a2ui0.5–a2ui0.6–a2ui0.7–a2ui0.8–a2ui0.9–a2ui0.10–a2ui0.11–a2ui0.12.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known