CVE-2026-118273: a2ui-project a2ui data-model.ts DataModel.set resource consumption
A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/webcore/src/v09/state/data-model.ts. Executing a manipulation can lead to resource consumption. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called 82789191ce551f4d7a095d273773fb24bd764c9d. A patch should be applied to remediate this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2ui-project/a2uito a version that resolves this vulnerability.Patch 82789191ce551f4d7a095d273773fb24bd764c9d
Event History
Frequently Asked Questions
Which deployments are affected?
a2ui-project a2ui versions up to and including 0.10.6 are affected. The vulnerable function is DataModel.set in renderers/web_core/src/v0_9/state/data-model.ts.
What access does an attacker need?
The attack can be launched remotely and requires low privileges. No user interaction is required.
What is the practical impact?
Successful manipulation can cause resource consumption, affecting availability. Public exploit material is available and may be used.
What should teams do to remediate the issue?
Apply patch 82789191ce551f4d7a095d273773fb24bd764c9d. The provided data does not identify an alternative mitigation if patching cannot be performed immediately.