CVE-2026-118538 | a2ui-project a2ui up to 0.12.0 Renderer src/0.8/ui/root.js Root.renderComponentTree dynamically-determined object attributes (Issue 3076)

October 28, 2026 Yanac

A vulnerability was found in a2ui-project a2ui up to 0.12.0. It has been declared as critical. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes.

The identification of this vulnerability is CVE-2026-118538. The attack may be launched remotely. There is no exploit available.

The pull request to fix this issue awaits acceptance.VulDB Recent EntriesRead More