CVE-2026-118272
mediumA vulnerability was detected in a2ui-project a2ui up to 0.10.6.
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error message. It is possible to initiate the attack remotely. The exploit is now public and may be used. The patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01. It is suggested to install a patch to address this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/a2ui-project/a2ui/ cna@vuldb.com
- https://github.com/a2ui-project/a2ui/commit/8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01 cna@vuldb.com
- https://github.com/a2ui-project/a2ui/issues/2385 cna@vuldb.com
- https://github.com/a2ui-project/a2ui/pull/2429 cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-118272 cna@vuldb.com
- https://vuldb.com/submit/1015116 cna@vuldb.com
- https://vuldb.com/vuln/427570 cna@vuldb.com
- https://vuldb.com/vuln/427570/cti cna@vuldb.com