CVE-2026-118537: a2ui Image Player/Video Player/Audio Player Image.js input validation

Q: Which deployments may be affected?

a2ui versions up to 0.10.4 may be affected where the Image Player, Video Player, or Audio Player uses the Image.js component at src/v0_9/basic_catalog/components/Image.js.

Q: What does an attacker need to exploit this issue?

The issue can be initiated remotely by manipulating the url argument. The supplied vector indicates no privileges are required, but user interaction is required.

Q: Is a fix available?

A pull request intended to fix the issue exists, but it was awaiting acceptance at the time of the report.

Published Oct 28, 2026

Updated

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v09/basiccatalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

Affected Software

1 affected component

a2ui<=0.10.4

Event History

Oct 28, 2026

CVE Published

via MITRE·09:45 PM

Data Sourced

via MITRE·09:45 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments may be affected?

a2ui versions up to 0.10.4 may be affected where the Image Player, Video Player, or Audio Player uses the Image.js component at src/v0_9/basic_catalog/components/Image.js.

What does an attacker need to exploit this issue?

The issue can be initiated remotely by manipulating the url argument. The supplied vector indicates no privileges are required, but user interaction is required.

Is a fix available?