CVE-2026-92357: Infoleak

Published Sep 16, 2026

Updated

A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument current[segment] leads to information disclosure. The attack may be initiated remotely. The identifier of the patch is 1b3bff234661ce922cbc3771be642b23ec9fd0fa. To fix this issue, it is recommended to deploy a patch.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade a2ui-project a2ui Model Processor model-processor.ts to a version that resolves this vulnerability.
Patch 1b3bff234661ce922cbc3771be642b23ec9fd0fa

Frequently Asked Questions

Which releases are identified as affected?

The affected a2ui releases are 0.8, 0.9, and 1.0.

What level of access does an attacker need?

The vulnerability can be initiated remotely, but the severity vector indicates that the attacker requires low-level privileges. No user interaction is required.

What is the expected impact if exploitation succeeds?

Successful exploitation may disclose information. The provided severity vector indicates low confidentiality impact and no stated integrity or availability impact.

What should teams do to remediate the issue?

Deploy the patch identified as 1b3bff234661ce922cbc3771be642b23ec9fd0fa. The available data does not provide a fixed release number.