{"id":"CVE-2026-118272","kind":"vulnerability","aliases":["CVE-2026-118272"],"related":[],"title":"a2ui web renderer error messages expose internal information remotely","description":"A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error message. It is possible to initiate the attack remotely. The exploit is now public and may be used. The patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01. It is suggested to install a patch to address this issue.","summary":"The a2ui web renderer's DataContext.dispatchExpressionError function, in renderers/web_core/src/v0_9/rendering/data-context.ts, returns error messages that reveal information when a crafted input is sent. An attacker who can reach the affected renderer can read that disclosed information, but the sources do not describe code execution or data modification.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["a2ui","javascript","package","web-renderer"],"not_affected_if":["renderer-not-used"],"how_to_check":"- Check the installed a2ui web_core version against the affected range up to `0.10.6`.\n- Look for `renderers/web_core/src/v0_9/rendering/data-context.ts` in the deployed source or bundle.\n- unknown: the sources do not give a package-manager command for this check.","fix":"- Apply the patch `8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01` to the a2ui web_core renderer.\n- Move to a release newer than `0.10.6` once the sources confirm which version contains the patch.","status":"open","published_at":"2026-10-28T02:17:07+00:00","first_seen_at":"2026-10-28T02:30:29+00:00","triaged_at":"2026-10-28T02:32:07+00:00","updated_at":"2026-10-28T02:32:07+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T02:32:07Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the patch `8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01` to the a2ui web_core renderer.\n- Move to a release newer than `0.10.6` once the sources confirm which version contains the patch.","reach":"internet","title":"a2ui web renderer error messages expose internal information remotely","impact":"low","summary":"The a2ui web renderer's DataContext.dispatchExpressionError function, in renderers/web_core/src/v0_9/rendering/data-context.ts, returns error messages that reveal information when a crafted input is sent. An attacker who can reach the affected renderer can read that disclosed information, but the sources do not describe code execution or data modification.","category":"package","nicknames":[],"who_cares":["a2ui","web-renderer","javascript"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote callers read information leaked through error messages","analyst_note":"Check the NVD entry and the a2ui repository for the affected version range, required setup, and the exact information leaked, since the sources give no install or check command.","how_to_check":"- Check the installed a2ui web_core version against the affected range up to `0.10.6`.\n- Look for `renderers/web_core/src/v0_9/rendering/data-context.ts` in the deployed source or bundle.\n- unknown: the sources do not give a package-manager command for this check.","needs_analyst":true,"not_affected_if":["renderer-not-used"],"who_is_affected":"Teams that run the a2ui web_core renderer at version `0.10.6` or earlier and expose its error output to remote users are affected. The sources do not say which deployment setups are exposed, so teams that do not use this renderer or do not return its error messages to outside callers can likely skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001001,"input_tokens":3393,"output_tokens":1324,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118272':12A,15A '-2026':11A,14A '0.10.6':78C '8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01':124C 'a2ui':1A,16B,23B,73C,75C 'a2ui-project':72C 'address':133C 'affect':49B,79C 'attack':44B,109C 'code':62B 'compon':90C 'craft':39B 'cve':10A,13A 'data':65B 'datacontext.dispatchexpressionerror':27B,83C 'describ':61B 'detect':70C 'disclos':54B 'error':4A,32B,91C,101C 'execut':63B 'exploit':112C 'expos':6A 'exposur':99C 'file':86C 'function':28B,82C 'handler':92C 'inform':8A,36B,55B,98C 'initi':107C 'input':40B 'instal':129C 'intern':7A 'issu':135C 'javascript':17B 'manipul':95C 'may':117C 'messag':5A,33B,102C 'modif':66B 'name':123C 'packag':18B 'patch':121C,131C 'perform':93C 'possibl':105C 'project':74C 'public':115C 'reach':47B 'read':52B 'remot':9A,110C 'render':3A,21B,25B,50B 'renderers/web_core/src/v0_9/rendering/data-context.ts':30B,87C 'result':96C 'return':31B 'reveal':35B 'sent':42B 'sourc':58B 'suggest':127C 'use':119C 'vulner':68C 'web':2A,20B,24B 'web-render':19B","nicknames":[],"mitigations":[],"who_affected":"Teams that run the a2ui web_core renderer at version `0.10.6` or earlier and expose its error output to remote users are affected. The sources do not say which deployment setups are exposed, so teams that do not use this renderer or do not return its error messages to outside callers can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T02:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118272","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118272","severity":null,"published_at":"2026-10-28T02:17:07+00:00","modified_at":"2026-10-28T02:17:07+00:00","first_seen_at":"2026-10-28T02:30:29+00:00","fetched_at":"2026-10-28T02:30:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}