TI-2026-82245 Aliases CVE-2026-118538 GHSA-4c8v-q557-73fw

Improperly controlled object attribute modification in a2ui Renderer

LOW 23CWE-913Published 2026-10-28 · Updated 2026-10-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Tampering
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-915.

Summary

The a2ui-project a2ui package up to 0.12.0 has a flaw in the Root.renderComponentTree function of the Renderer component in src/0.8/ui/root.js. The code lets object attributes be modified in a way that is not properly controlled (CWE-915). A remote attacker with low privileges can trigger it with user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00299 22nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
a2ui-project	a2ui	0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11; 0.12.0	—	No fix listed	CNA

a2ui Vendora2ui-project Affected 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11; 0.12.0 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:a2ui-project:a2ui::::::::	—	—	—

cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

The sources list no fixed version for a2ui.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-28 Threatist record created from CVE-2026-118538
2026-10-29 Alias added: GHSA-4c8v-q557-73fw
2026-10-29 CISA SSVC decision points changed

References

Patch 1

https://github.com/a2ui-project/a2ui/pull/3107

Other 2

TI-2026-81673 Uncontrolled resource consumption in a2ui Resolver CVSS 4.0MEDIUM 6.9
TI-2026-81667 Uncontrolled resource consumption in a2ui Binder component CVSS 4.0MEDIUM 5.3
TI-2026-81657 Resource consumption in a2ui-project a2ui DataModel.set CVSS 4.0MEDIUM 5.3
TI-2026-81656 Error message exposes information in a2ui-project a2ui CVSS 4.0MEDIUM 5.3
TI-2026-81638 Uncontrolled resource consumption in a2ui data-context Resolver CVSS 4.0MEDIUM 5.3
TI-2026-81674 Uncontrolled resource consumption in a2ui expression parser CVSS 4.0MEDIUM 5.1

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences