Live › vulnerability › CVE-2026-118276
Go to dashboardThe formatString function in the a2ui web renderer's expression parser can be driven into heavy resource consumption by crafted input. An attacker who can send that input remotely can slow down or stall the rendering process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 04:30 UTC. All times on this page are UTC.
Teams that run the a2ui web renderer up to version 0.10.6 with the basic catalog expression parser exposed to input they do not fully control. The sources do not say which deployments route untrusted input into formatString. Teams not using the a2ui web renderer can skip it.
No product ranges from the sources yet.
0.10.6 or earlierrenderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts file contains the fix from commit 1f71d1aac1b145ef57c7526f9e0cff316f5934e21f71d1aac1b145ef57c7526f9e0cff316f5934e2 to the a2ui web renderer0.10.6 that includes this patch (exact release version unknown)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts of the component Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 1f71d1aac1b145ef57c7526f9e0cff316f5934e2. Applying a patch is the recommended action to fix this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-118276")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.