CVE-2026-118276 Details
Description
A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts of the component Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 1f71d1aac1b145ef57c7526f9e0cff316f5934e2. Applying a patch is the recommended action to fix this issue.
A denial-of-service vulnerability has been identified in the A2UI project, specifically in versions through 0.10.6. The issue arises in the expression parser component, where the 'formatString' function can be exploited to cause excessive resource consumption. This vulnerability allows for multi-second parsing delays, which can freeze the user interface. The problem has been publicly disclosed and a patch is available.
Users can update to A2UI version 0.10.7 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/a2ui-project/a2ui/ | [email protected] | Vendor |
| https://github.com/a2ui-project/a2ui/commit/1f71d1aac1b145ef57c7526f9e0cff316f5934e2 | [email protected] | Source CodeVendor |
| https://github.com/a2ui-project/a2ui/issues/2389 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/a2ui-project/a2ui/pull/2433 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-118276 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1015139 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/427574 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/427574/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| a2ui-project a2ui | <= 0.10.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |