Medium severity4.3NVD Advisory· Published Oct 28, 2026

CVE-2026-118537

Description

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

Patches

Vulnerability mechanics

References

github.com/a2ui-project/a2ui/issues/3077nvd
github.com/a2ui-project/a2ui/pull/3108nvd
vuldb.com/cve/CVE-2026-118537nvd
vuldb.com/submit/1020092nvd
vuldb.com/vuln/428014nvd
vuldb.com/vuln/428014/ctinvd

News mentions

No linked articles in our index yet.