CVE-2026-118273
a2ui-project a2ui data-model.ts DataModel.set resource consumption
a2ui-project a2ui
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/web_core/src/v0_9/state/data-model.ts. Executing a manipulation can lead to resource consumption. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called 82789191ce551f4d7a095d273773fb24bd764c9d. A patch should be applied to remediate this issue.
Text from CVE List
Affected versions 7
- a2uiaffected: 0.10.0CVE List
- a2uiaffected: 0.10.1CVE List
- a2uiaffected: 0.10.2CVE List
- a2uiaffected: 0.10.3CVE List
- a2uiaffected: 0.10.4CVE List
- a2uiaffected: 0.10.5CVE List
- a2uiaffected: 0.10.6CVE List
References 8
- github.com/a2ui-project/a2ui/pull/2430Fixvia CVE List
- github.com/a2ui-project/a2ui/commit/82789191ce551f4d7a095d273773fb24bd764c9dFixvia CVE List
- vuldb.com/cve/CVE-2026-118273Advisoryvia CVE List
- vuldb.com/submit/1015117Advisoryvia CVE List
- github.com/a2ui-project/a2ui/issues/2386Exploitvia CVE List
- vuldb.com/vuln/427571Referencevia CVE List
- vuldb.com/vuln/427571/ctiReferencevia CVE List
- github.com/a2ui-project/a2ui/Referencevia CVE List