EUVD-2026-112510

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v09/basiccatalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may ...

EUVD-2026-112546

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely...

CVE-2026-118538

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely...

CVE-2026-118537

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v09/basiccatalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may ...

CVE-2026-118538 a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely...

CVE-2026-118538 a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely...

CVE-2026-118538 a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely...

CVE-2026-118538

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely...

CVE-2026-118538

The a2ui-project a2ui component (versions up to 0.12.0 ) is vulnerable due to an issue in the Renderer component's Root.renderComponentTree function, located in src/0.8/ui/root.js. A remote attacker can execute a manipulation leading to dynamically-determined object attributes (CWE-915, CWE-913)....

CVE-2026-118537

The a2ui software versions up to 0.10.4 are affected by a vulnerability in the Image Player/Video Player/Audio Player component. The flaw resides in the src/v0_9/basic_catalog/components/Image.js file, where a manipulation of the url argument leads to improper input validation . This issue can be...

CVE-2026-118537 a2ui Image Player/Video Player/Audio Player Image.js input validation

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v09/basiccatalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may ...

CVE-2026-118537

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v09/basiccatalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may ...

Allocation of Resources Without Limits or Throttling

Overview @a2ui/webcore is an A2UI Core Library Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the parse method of the ExpressionParser class. An attacker can block the main thread of the client, on every re-resolution when the bound dat...

@a2ui/angular (>=0.8.3, <=0.10.7), @a2ui/lit (>=0.8.2, <=0.11.0) +118 more potentially affected by CVE-2026-118276 via @a2ui/web_core (>=0.8.0, <=0.11.0)

@a2ui/webcore NPM version =0.8.0, =0.8.3, =0.8.2, =0.8.0, =0.0.1-beta.1, =0.0.1-beta.1, =0.0.1-beta.1, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.5.1 and more Source cves: CVE-2026-118276 Source advisory: SNYK:JS-A2UIWEBCORE-21762819...

@a2ui/angular (>=0.8.3, <=0.10.7), @a2ui/lit (>=0.8.2, <=0.11.0) +118 more potentially affected by CVE-2026-118272 via @a2ui/web_core (>=0.8.0, <=0.11.0)

@a2ui/webcore NPM version =0.8.0, =0.8.3, =0.8.2, =0.8.0, =0.0.1-beta.1, =0.0.1-beta.1, =0.0.1-beta.1, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.5.1 and more Source cves: CVE-2026-118272 Source advisory: SNYK:JS-A2UIWEBCORE-21762820...

Information Exposure

Overview @a2ui/webcore is an A2UI Core Library Affected versions of this package are vulnerable to Information Exposure via DataContext.dispatchExpressionError in data-context.ts, which attaches the raw V8 execution stack trace e.stack to error events dispatched through surface.onError. When an...

@a2ui/angular (>=0.8.3, <=0.10.7), @a2ui/lit (>=0.8.2, <=0.11.0) +118 more potentially affected by CVE-2026-118273 via @a2ui/web_core (>=0.8.0, <=0.11.0)

@a2ui/webcore NPM version =0.8.0, =0.8.3, =0.8.2, =0.8.0, =0.0.1-beta.1, =0.0.1-beta.1, =0.0.1-beta.1, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.5.1 and more Source cves: CVE-2026-118273 Source advisory: SNYK:JS-A2UIWEBCORE-21762818...

Allocation of Resources Without Limits or Throttling

Overview @a2ui/webcore is an A2UI Core Library Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via DataModel.set in data-model.ts when a caller sets data at a large array index e.g., /items/10000000. The target array expands without an uppe...

@a2ui/angular (>=0.8.3, <=0.10.7), @a2ui/lit (>=0.8.2, <=0.11.0) +118 more potentially affected by CVE-2026-118275 via @a2ui/web_core (>=0.8.0, <=0.11.0)

@a2ui/webcore NPM version =0.8.0, =0.8.3, =0.8.2, =0.8.0, =0.0.1-beta.1, =0.0.1-beta.1, =0.0.1-beta.1, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.5.1 and more Source cves: CVE-2026-118275 Source advisory: SNYK:JS-A2UIWEBCORE-21762817...

@a2ui/angular (>=0.8.3, <=0.10.7), @a2ui/lit (>=0.8.2, <=0.11.0) +118 more potentially affected by CVE-2026-118274 via @a2ui/web_core (>=0.8.0, <=0.11.0)

@a2ui/webcore NPM version =0.8.0, =0.8.3, =0.8.2, =0.8.0, =0.0.1-beta.1, =0.0.1-beta.1, =0.0.1-beta.1, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.5.1 and more Source cves: CVE-2026-118274 Source advisory: SNYK:JS-A2UIWEBCORE-21762816...