Live › vulnerability › CVE-2026-118274
Go to dashboardA flaw in the generic binder of the a2ui web renderer (renderers/web_core, v0_9 rendering) lets a remote party make it consume excessive resources. The exploit is public, and the sources report a patch commit but no fixed release version.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Teams that run the a2ui web renderer (web_core) with version or earlier are in scope, because the flawed binder runs when the renderer processes input. Systems that do not use a2ui's web renderer can skip it. The sources do not say which data paths reach the binder.
0.10.6No product ranges from the sources yet.
0.10.6 or earlier, for example in the lockfile or package.json.renderers/web_core/src/v0_9/rendering/generic-binder.ts in the installed or vendored a2ui source.c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e to a2ui.0.10.6 once one with the patch is published (the sources do not name a version).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e. To fix this issue, it is recommended to deploy a patch.
This page as .md · .json · in your agent: get_signal("CVE-2026-118274")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.