---
id: "CVE-2026-118538"
kind: "vulnerability"
aliases: ["CVE-2026-118538"]
title: "a2ui: renderer flaw lets remote input control dynamically determined object attributes"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["a2ui", "javascript", "package"]
not_affected_if: []
published_at: "2026-10-28T22:17:12+00:00"
first_seen_at: "2026-10-28T22:35:34+00:00"
updated_at: "2026-10-28T22:36:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118538", "first_seen_at": "2026-10-28T22:35:34+00:00"}]
---

# a2ui: renderer flaw lets remote input control dynamically determined object attributes

In a2ui up to 0.12.0, the Root.renderComponentTree function in the 0.8 renderer lets crafted input manipulate dynamically determined object attributes. The sources do not say what an attacker can reach beyond that, and the fix is only a pending pull request.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-28T22:35:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118538

## From the sources

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_