CVE-2026-118538 Details
Description
A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.
A vulnerability exists in the A2UI project, specifically in the A2UI library version 0.12.0 and prior. The issue is located in the Renderer component, within the Root.renderComponentTree function of the file src/0.8/ui/root.js. This vulnerability allows for improper modification of dynamically-determined object attributes, which can be exploited remotely. The problem arises because the legacy Lit renderer directly spreads server-controlled property names onto elements without any validation, enabling injection of arbitrary HTML or manipulation of element attributes that could lead to cross-site scripting (XSS) attacks.
Users can update to A2UI version 0.12.1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/a2ui-project/a2ui/ | [email protected] | Vendor |
| https://github.com/a2ui-project/a2ui/issues/3076 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/a2ui-project/a2ui/pull/3107 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-118538 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1020095 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/428015 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/428015/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-913 | Improper Control of Dynamically-Managed Code Resources | [email protected] |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| a2ui-project a2ui | <= 0.12.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |