CVE-2026-118271
a2ui-project a2ui data-context Resolver data-context.ts resource consumption
a2ui-project a2ui
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is eb314e14fabd29cfb4a74e1202afc4fe2081efa2. Applying a patch is advised to resolve this issue.
Text from CVE List
Affected versions 7
- a2uiaffected: 0.10.0CVE List
- a2uiaffected: 0.10.1CVE List
- a2uiaffected: 0.10.2CVE List
- a2uiaffected: 0.10.3CVE List
- a2uiaffected: 0.10.4CVE List
- a2uiaffected: 0.10.5CVE List
- a2uiaffected: 0.10.6CVE List
References 8
- github.com/a2ui-project/a2ui/pull/2417Fixvia CVE List
- github.com/a2ui-project/a2ui/commit/eb314e14fabd29cfb4a74e1202afc4fe2081efa2Fixvia CVE List
- vuldb.com/cve/CVE-2026-118271Advisoryvia CVE List
- vuldb.com/submit/1015115Advisoryvia CVE List
- github.com/a2ui-project/a2ui/issues/2384Exploitvia CVE List
- vuldb.com/vuln/427569Referencevia CVE List
- vuldb.com/vuln/427569/ctiReferencevia CVE List
- github.com/a2ui-project/a2ui/Referencevia CVE List