Live › vulnerability › CVE-2026-118275
Go to dashboardThe a2ui web renderer's DataContext.resolveSignal function, up to version 0.10.6, can be manipulated to consume resources. The sources say the attack can be launched remotely and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 04:30 UTC. All times on this page are UTC.
No product ranges from the sources yet.
renderers/web_core against 0.10.6DataContext.resolveSignal in renderers/web_core/src/v0_9/rendering/data-context.tsc76e17272e52c12c6dcf68905b1df978c39e9aa5 or move to a release newer than 0.10.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as c76e17272e52c12c6dcf68905b1df978c39e9aa5. It is advisable to implement a patch to correct this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-118275")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.