Live › vulnerability › CVE-2026-118537
Go to dashboardThe a2ui library up to version 0.10.4 does not properly validate the url argument in its Image, Player, Video Player and Audio Player component (src/v0_9/basic_catalog/components/Image.js). An attacker can supply a crafted url value remotely, and the sources do not say what the resulting impact is beyond improper input validation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Teams that render a2ui player or media components with a url value that comes from users or other untrusted input are the ones exposed. Applications that only render hardcoded or server-controlled media URLs are less exposed. The sources do not say which deployments are most at risk.
No product ranges from the sources yet.
npm ls a2ui or in package.json, and treat anything at or below 0.10.4 as affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.
This page as .md · .json · in your agent: get_signal("CVE-2026-118537")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.