CVE-2026-118271
a2ui-project a2ui data-context Resolver data-context.ts resource consumption
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is eb314e14fabd29cfb4a74e1202afc4fe2081efa2. Applying a patch is advised to resolve this issue.
| CWE | CWE-400 CWE-404 |
| Vendor | a2ui-project |
| Product | a2ui |
| Published | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for a2ui-project a2ui
Be the first to know when new medium vulnerabilities affecting a2ui-project a2ui are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
a2ui-project / a2ui
0.10.0 0.10.1 0.10.2 0.10.3 0.10.4 0.10.5 0.10.6
References
vuldb.com: https://vuldb.com/vuln/427569 vuldb.com: https://vuldb.com/vuln/427569/cti vuldb.com: https://vuldb.com/cve/CVE-2026-118271 vuldb.com: https://vuldb.com/submit/1015115 github.com: https://github.com/a2ui-project/a2ui/issues/2384 github.com: https://github.com/a2ui-project/a2ui/pull/2417 github.com: https://github.com/a2ui-project/a2ui/commit/eb314e14fabd29cfb4a74e1202afc4fe2081efa2 github.com: https://github.com/a2ui-project/a2ui/
Credits
🔍 ez-lbz (VulDB User)