CVE-2026-92213 Details
Description
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible to be carried out remotely. The patch is named fb8e85aec78d04e81feb9992a57638ca1ec4dc1b. It is suggested to install a patch to address this issue.
A vulnerability exists in the A2UI project, specifically in versions up to 0.10.6, within the Angular renderer. The issue arises because theme values, such as 'primaryColor', are accepted without proper validation and are directly used as CSS properties. This flaw enables the injection of malicious URLs, which can be exploited to create cross-origin requests, potentially disclosing sensitive information like the user's IP address and User-Agent. The problem is exacerbated by the fact that the Angular renderer's button component, which consumes these theme values, can inadvertently load images from the injected URLs, leading to UI spoofing.
The vulnerability has been addressed in version 0.10.7 by implementing proper validation for theme values. Users are advised to update to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/a2ui-project/a2ui/ | [email protected] | ProductSource CodeVendor |
| https://github.com/a2ui-project/a2ui/commit/fb8e85aec78d04e81feb9992a57638ca1ec4dc1b | [email protected] | Source CodeVendor |
| https://github.com/a2ui-project/a2ui/issues/2293 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/a2ui-project/a2ui/pull/2367 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-92213 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/934101 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/404458 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/404458/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-707 | Improper Neutralization | [email protected] |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| a2ui-project a2ui | <= 0.10.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |