Description
A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.
Published: 2026-10-28
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.
Title a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes
First Time appeared A2ui-project
A2ui-project a2ui
Weaknesses CWE-913
CWE-915
CPEs cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*
Vendors & Products A2ui-project
A2ui-project a2ui
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 5.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

A2ui-project A2ui
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-28T22:00:18.460Z

Reserved: 2026-10-28T15:49:52.145Z

Link: CVE-2026-118538

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T22:17:12.437

Modified: 2026-10-28T22:17:12.437

Link: CVE-2026-118538

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-913

    Improper Control of Dynamically-Managed Code Resources

  • CWE-915

    Improperly Controlled Modification of Dynamically-Determined Object Attributes