PT-2026-127805

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/web core/src/v0 9/basic catalog/expressions/expression parser.ts of the component Parser. This manipulation causes resource consumption. The attack may be...

PT-2026-127789

A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/web core/src/v0 9/state/data-model.ts. Executing a manipulation can lead to resource consumption. It is possible to launch the attack remotely. The exploit h...

CVE-2026-118274: a2ui-project a2ui: A vulnerability has been found in a2ui-project a2ui up to 0.10.6

A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be initiated remotely. T...

A2UI resource management error vulnerability

Versions A2UI 0.10.6 and earlier contain a resource management error vulnerability. This vulnerability stems from a resource consumption issue in the file renderers/webcore/src/v09/rendering/generic-binder.ts within the Binder component, which may lead to a denial of service...

CVE-2026-118275: a2ui-project a2ui: A vulnerability was found in a2ui-project a2ui up to 0.10.6

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The...

CVE-2026-118276: a2ui-project a2ui: A vulnerability was determined in a2ui-project a2ui up to 0.10.6

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/webcore/src/v09/basiccatalog/expressions/expressionparser.ts of the component Parser. This manipulation causes resource consumption. The attack may be...

CVE-2026-118273: a2ui-project a2ui: A flaw has been found in a2ui-project a2ui up to 0.10.6

A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/webcore/src/v09/state/data-model.ts. Executing a manipulation can lead to resource consumption. It is possible to launch the attack remotely. The exploit has...

PT-2026-127790

A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web core/src/v0 9/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be initiated remotely...

PT-2026-129207

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0 9/basic catalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack ma...

PT-2026-127804

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web core/src/v0 9/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The...

PT-2026-127735

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web core/src/v0 9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error...

A2UI resource management error vulnerability

Versions A2UI 0.10.6 and earlier contain a resource management error vulnerability. This vulnerability arises from improper handling by the DataContext.resolveSignal function within the Resolver component when processing the file rendering webcore/src/v09/rendering/data-context.ts, resulting in...

PT-2026-127313

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web core/src/v0 9/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed fro...

A2UI information disclosure vulnerability

Versions A2UI 0.10.6 and earlier contain an information disclosure vulnerability. This vulnerability stems from improper handling of the DataContext.dispatchExpressionError function in the file renderers/webcore/src/v09/rendering/data-context.ts within the Error Handler component. As a result,...

A2UI resource management error vulnerability

Versions A2UI 0.10.6 and earlier contain a resource management error vulnerability. This vulnerability stems from improper handling of the DataModel.set function in the file renderers/webcore/src/v09/state/data-model.ts, potentially leading to excessive resource consumption...

@a2ui/angular (>=0.9.0-alpha.0, <=0.9.1), @a2ui/lit (>=0.9.1, <=0.9.3) +46 more potentially affected by CVE-2026-10032 via @a2ui/web_core (>=0.9.0, <=0.9.2)

@a2ui/webcore NPM version =0.9.0, =0.9.0-alpha.0, =0.9.1, =0.9.0-alpha.0, =0.0.1-beta.1, =0.0.1-beta.1, =0.0.1-beta.1, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.5.1 and more Source cves: CVE-2026-10032 Source advisory: SNYK:JS-A2UIWEBCORE-21694039...

@a2ui/angular (>=0.9.0-alpha.0, <=0.9.1), @a2ui/lit (>=0.9.1, <=0.9.3) +46 more potentially affected by CVE-2026-10032 via @a2ui/web_core (>=0.9.0, <=0.9.2)

@a2ui/webcore NPM version =0.9.0, =0.9.0-alpha.0, =0.9.1, =0.9.0-alpha.0, =0.0.1-beta.1, =0.0.1-beta.1, =0.0.1-beta.1, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.5.1 and more Source cves: CVE-2026-10032 Source advisory: OSV:GHSA-72QQ-P3R5-F7WQ...

Cross-site Scripting (XSS)

Overview @a2ui/webcore is an A2UI Core Library Affected versions of this package are vulnerable to Cross-site Scripting XSS via the OpenUrlImplementation function in basicfunctions.ts, which passes a caller-supplied URL directly to window.open without validating the URL scheme. An attacker can...

GHSA-72QQ-P3R5-F7WQ @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Summary The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitra...

@a2ui/angular (>=0.9.0-alpha.0, <=0.9.1), @a2ui/lit (>=0.9.1, <=0.9.3) +46 more potentially affected by CVE-2026-10032 via @a2ui/web_core (>=0.9.0, <=0.9.2)

@a2ui/webcore NPM version =0.9.0, =0.9.0-alpha.0, =0.9.1, =0.9.0-alpha.0, =0.0.1-beta.1, =0.0.1-beta.1, =0.0.1-beta.1, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.5.1 and more Source cves: CVE-2026-10032 Source advisory: GHSA-72QQ-P3R5-F7WQ...