Improper input validation in a2ui media player components
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
The a2ui package, versions up to 0.10.4, is affected. The Image component in src/v0_9/basic_catalog/components/Image.js does not properly validate the url argument (CWE-20). A remote attacker without privileges can exploit this if a user interacts with the Image Player, Video Player or Audio Player component.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | a2ui | 0.10.0; 0.10.1; 0.10.2; 0.10.3; 0.10.4 | — | No fix listed | CNA |
- a2ui Vendor— Affected 0.10.0; 0.10.1; 0.10.2; 0.10.3; 0.10.4 Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:a2ui:a2ui:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:a2ui:a2ui:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
The sources list no fixed version for a2ui. A pull request to fix this issue awaits acceptance.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Timeline
- 2026-10-28 Threatist record created from CVE-2026-118537
- 2026-10-29 Alias added: GHSA-86jh-jpxp-vvrc
- 2026-11-03 CISA SSVC decision points changed
References
Sources
- CVE-2026-118537 · CVE Program
- CVE-2026-118537 · NVD
- FIRST EPSS
- GHSA-86jh-jpxp-vvrc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences