CVE-2026-118276: a2ui-project a2ui Parser expression_parser.ts formatString resource consumption
A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/webcore/src/v09/basiccatalog/expressions/expressionparser.ts of the component Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 1f71d1aac1b145ef57c7526f9e0cff316f5934e2. Applying a patch is the recommended action to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2ui-project/a2uito a version that resolves this vulnerability.Patch 1f71d1aac1b145ef57c7526f9e0cff316f5934e2
Event History
Frequently Asked Questions
Which deployments are affected?
a2ui-project a2ui versions up to 0.10.6 are affected. The issue is in the Parser component's formatString function in renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts.
What does an attacker need to exploit this issue?
The attack can be initiated remotely and requires low privileges and user interaction according to the supplied vector. Public exploit disclosure means exploitation may be practical.
What is the impact of successful exploitation?
Successful manipulation causes resource consumption, resulting in an availability impact. The provided severity vector indicates no confidentiality or integrity impact.
What should be done if the affected version is in use?
Apply patch 1f71d1aac1b145ef57c7526f9e0cff316f5934e2. Applying the patch is the recommended remediation.