CVE-2026-118538: a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes
A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
a2ui-project a2ui versions up to and including 0.12.0 are identified as affected. The issue is in the Renderer component, specifically Root.renderComponentTree in src/0.8/ui/root.js.
What access does an attacker need?
The attack can be launched remotely, but the supplied severity vector indicates that the attacker needs low-level privileges and user interaction. Exploitation is assessed as low complexity.
Is a fix available?
A pull request intended to fix the issue exists, but it is awaiting acceptance. No released fixed version is identified in the provided information.
What impact is reported if exploitation succeeds?
The supplied vector rates confidentiality, integrity, and availability impact as low. The overall reported severity is medium, with a CVSS score of 5.5.