Live › vulnerability › CVE-2026-118538
Go to dashboardIn a2ui up to 0.12.0, the Root.renderComponentTree function in the 0.8 renderer lets crafted input manipulate dynamically determined object attributes. The sources do not say what an attacker can reach beyond that, and the fix is only a pending pull request.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.
This page as .md · .json · in your agent: get_signal("CVE-2026-118538")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.