Medium severity5.5NVD Advisory· Published Oct 28, 2026

CVE-2026-118538

Description

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.

Patches

Vulnerability mechanics

References

github.com/a2ui-project/a2ui/issues/3076nvd
github.com/a2ui-project/a2ui/pull/3107nvd
vuldb.com/cve/CVE-2026-118538nvd
vuldb.com/submit/1020095nvd
vuldb.com/vuln/428015nvd
vuldb.com/vuln/428015/ctinvd

News mentions

No linked articles in our index yet.