CVE-2026-118272: a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error message. It is possible to initiate the attack remotely. The exploit is now public and may be used. The patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01. It is suggested to install a patch to address this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2ui-project/a2uito a version that resolves this vulnerability.Patch 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01
Event History
Frequently Asked Questions
Which deployments are affected?
a2ui-project a2ui versions up to 0.10.6 are affected. The issue is in the Error Handler component, specifically DataContext.dispatchExpressionError in renderers/web_core/src/v0_9/rendering/data-context.ts.
What does an attacker need to exploit this issue?
The attack can be initiated remotely and requires low privileges. No user interaction is required, and exploitation involves manipulating input to expose information through an error message.
Is exploitation known to be practical?
Yes. A public exploit is available and may be used.
What should teams do to remediate the issue?
Install the patch identified as commit 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01. The provided data does not identify an alternative mitigation if patching cannot be performed immediately.