Live › vulnerability › CVE-2026-118272
Go to dashboardThe a2ui web renderer's DataContext.dispatchExpressionError function, in renderers/web_core/src/v0_9/rendering/data-context.ts, returns error messages that reveal information when a crafted input is sent. An attacker who can reach the affected renderer can read that disclosed information, but the sources do not describe code execution or data modification.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 02:30 UTC. All times on this page are UTC.
Teams that run the a2ui web_core renderer at version or earlier and expose its error output to remote users are affected. The sources do not say which deployment setups are exposed, so teams that do not use this renderer or do not return its error messages to outside callers can likely skip it.
0.10.6No product ranges from the sources yet.
0.10.6.renderers/web_core/src/v0_9/rendering/data-context.ts in the deployed source or bundle.8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01 to the a2ui web_core renderer.0.10.6 once the sources confirm which version contains the patch.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error message. It is possible to initiate the attack remotely. The exploit is now public and may be used. The patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01. It is suggested to install a patch to address this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-118272")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.