CVE-2026-92214 Details

A cross-site scripting (XSS) vulnerability has been identified in the A2UI Project A2UI, specifically in versions up to 0.10.7. The issue arises in the A2A Chat Canvas component, within a function of the file 'sanitizer-markdown-renderer-service.ts'. The vulnerability allows remote execution of scripts by bypassing Angular's HTML sanitization, as the default text renderer improperly handles raw agent text by using 'bypassSecurityTrustHtml' and binding it with 'innerHTML'. This flaw can be exploited by sending an agent message containing malicious HTML, which is then executed in the context of the host application.

The vulnerability can be addressed by making a sanitizing pipeline the default renderer, using a method that properly handles HTML, such as the 'markdown-it' option available in other parts of the project.