Uncontrolled Recursion

Overview @a2ui/webcore is an A2UI Core Library Affected versions of this package are vulnerable to Uncontrolled Recursion via DataContext.resolveDynamicValue and DataContext.resolveSignal in data-context.ts. When resolving DynamicValue payloads that contain nested function call objects call: "......

Allocation of Resources Without Limits or Throttling

Overview @a2ui/webcore is an A2UI Core Library Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded dynamic ChildList materialization in GenericBinder and NodeResolver. When a container component is bound to a large data-model arra...

CVE-2026-118276

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/webcore/src/v09/basiccatalog/expressions/expressionparser.ts of the component Parser. This manipulation causes resource consumption. The attack may be...

CVE-2026-118275

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The...

EUVD-2026-111578

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/webcore/src/v09/basiccatalog/expressions/expressionparser.ts of the component Parser. This manipulation causes resource consumption. The attack may be...

CVE-2026-118276 a2ui-project a2ui Parser expression_parser.ts formatString resource consumption

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/webcore/src/v09/basiccatalog/expressions/expressionparser.ts of the component Parser. This manipulation causes resource consumption. The attack may be...

CVE-2026-118276

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/webcore/src/v09/basiccatalog/expressions/expressionparser.ts of the component Parser. This manipulation causes resource consumption. The attack may be...

CVE-2026-118276 a2ui-project a2ui Parser expression_parser.ts formatString resource consumption

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/webcore/src/v09/basiccatalog/expressions/expressionparser.ts of the component Parser. This manipulation causes resource consumption. The attack may be...

CVE-2026-118276

The a2ui-project a2ui component, up to version 0.10.6 , is vulnerable to a resource consumption issue. The flaw exists in the formatString function within the file renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts of the Parser component. An attacker may initiate this att...

CVE-2026-118276 a2ui-project a2ui Parser expression_parser.ts formatString resource consumption

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/webcore/src/v09/basiccatalog/expressions/expressionparser.ts of the component Parser. This manipulation causes resource consumption. The attack may be...

@a2ui/angular (>=0.9.0-alpha.0, <=0.10.7), @a2ui/lit (>=0.9.1, <=0.11.0) +108 more potentially affected by CVE-2026-118276 via @a2ui/web_core (>=0.9.0, <=0.11.0)

@a2ui/webcore NPM version =0.9.0, =0.9.0-alpha.0, =0.9.1, =0.9.0-alpha.0, =0.0.1-beta.1, =0.0.1-beta.1, =0.0.1-beta.1, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.5.1 and more Source cves: CVE-2026-118276 Source advisory: MEND:CVE-2026-118276...

CVE-2026-118275

A vulnerability exists in a2ui-project a2ui up to version 0.10.6 within the Resolver component. Specifically, the DataContext.resolveSignal function in renderers/web_core/src/v0_9/rendering/data-context.ts is susceptible to uncontrolled resource consumption (CWE-400, CWE-404). This issue can be t...

CVE-2026-118275 a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The...

EUVD-2026-111573

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The...

@a2ui/angular (>=0.9.0-alpha.0, <=0.10.7), @a2ui/lit (>=0.9.1, <=0.11.0) +108 more potentially affected by CVE-2026-118275 via @a2ui/web_core (>=0.9.0, <=0.11.0)

@a2ui/webcore NPM version =0.9.0, =0.9.0-alpha.0, =0.9.1, =0.9.0-alpha.0, =0.0.1-beta.1, =0.0.1-beta.1, =0.0.1-beta.1, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.5.1 and more Source cves: CVE-2026-118275 Source advisory: MEND:CVE-2026-118275...

CVE-2026-118275

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The...

CVE-2026-118275 a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The...

CVE-2026-118275 a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The...

CVE-2026-118274

A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be initiated remotely. T...

CVE-2026-118273

A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/webcore/src/v09/state/data-model.ts. Executing a manipulation can lead to resource consumption. It is possible to launch the attack remotely. The exploit has...