Live › vulnerability › CVE-2026-118273
Go to dashboardThe a2ui web renderer's DataModel.set function in renderers/web_core can be manipulated to consume excessive resources. A remote attacker can trigger it, and a public exploit has been published, which can slow or stall the affected renderer.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Teams that run the a2ui web renderer (renderers/web_core) in an application that accepts input which reaches DataModel.set, including data sent from remote clients. Projects that do not use this renderer, or that run a version later than 0.10.6 with the patch applied, can skip it.
No product ranges from the sources yet.
npm ls in the project directory.82789191ce551f4d7a095d273773fb24bd764c9d from the a2ui-project repository.0.10.6; the fixed version number is unknown.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/web_core/src/v0_9/state/data-model.ts. Executing a manipulation can lead to resource consumption. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called 82789191ce551f4d7a095d273773fb24bd764c9d. A patch should be applied to remediate this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-118273")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.