CVE-2026-118273 in a2ui
Summary
by MITRE • 10/28/2026
A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/web_core/src/v0_9/state/data-model.ts. Executing a manipulation can lead to resource consumption. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called 82789191ce551f4d7a095d273773fb24bd764c9d. A patch should be applied to remediate this issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in the a2ui-project, specifically within versions up to 0.10.6, represents a significant security risk due to its potential for remote exploitation and resource exhaustion. The flaw resides in the DataModel.set function located in the file renderers/web_core/src/v0_9/state/data-model.ts. This component is critical for managing state data within the application's rendering engine, making it an attractive target for attackers seeking to disrupt service availability or degrade system performance.
From a technical perspective, this vulnerability falls under the category of Improper Input Validation as defined by CWE-20 and potentially relates to Denial of Service via resource consumption as outlined in CWE-400. The core issue stems from insufficient validation or sanitization of input data passed to the DataModel.set function. When an attacker provides manipulated or malformed inputs, the application fails to handle these anomalies gracefully, leading to excessive memory allocation, infinite loops, or other forms of unbounded resource consumption. This behavior allows a remote adversary to trigger conditions that severely impact system stability without requiring authentication in many configurations, aligning with ATT&CK technique T1496 Resource Hijacking if used for cryptomining, though here it primarily serves as a Denial of Service vector under T1499 Endpoint Denial of Service.
The operational impact of this vulnerability is substantial, particularly because the exploit has been published and is actively available in the wild. Remote attackers can leverage this flaw to launch denial-of-service attacks against systems running affected versions of a2ui. By repeatedly sending crafted requests that trigger the flawed code path, an attacker can consume significant CPU cycles or memory resources on the target server. This leads to service degradation for legitimate users, potential crashes of the web application, and increased infrastructure costs due to the need for additional resources to mitigate the attack traffic. In environments where a2ui is used as part of a larger content management or rendering pipeline, this disruption can cascade into broader operational failures.
To remediate this issue, it is imperative that organizations immediately apply patch 82789191ce551f4d7a095d273773fb24bd764c9d or upgrade to a version of a2ui newer than 0.10.6 where the vulnerability has been addressed. The patch likely introduces stricter input validation, bounds checking, and resource limits within the DataModel.set function to prevent excessive consumption. In addition to applying the software update, security teams should implement network-level mitigations such as rate limiting on endpoints that interact with the data model functionality. This helps to throttle malicious traffic before it can exhaust system resources. Furthermore, deploying Web Application Firewalls configured to detect anomalous request patterns associated with this specific vulnerability can provide an additional layer of defense while patching efforts are completed across all affected instances.