CVE-2026-92213: a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/webcore/src/v09/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible to be carried out remotely. The patch is named fb8e85aec78d04e81feb9992a57638ca1ec4dc1b. It is suggested to install a patch to address this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2ui-project a2ui (Angular Renderer)to a version that resolves this vulnerability.Patch fb8e85aec78d04e81feb9992a57638ca1ec4dc1b
Event History
Frequently Asked Questions
Which deployments are affected?
a2ui-project a2ui versions up to and including 0.10.6 are affected where the Angular Renderer component is in use. The affected code is the z.any function in renderers/web_core/src/v0_9/schema/server-to-client.ts.
What does an attacker need to exploit this issue?
The issue can be exploited remotely by manipulating the primaryColor argument. The provided information does not specify any further prerequisites such as required privileges or a particular configuration.
What should teams do to remediate it?
Install the patch identified as fb8e85aec78d04e81feb9992a57638ca1ec4dc1b. No alternative mitigation is provided in the available information.