| शीर्षक | a2ui-project a2ui <=0.10.6 CWE-400 |
|---|
| विवरण | DataModel.set('/items/<huge-index>', value) grows the target array's length to the index (no maximum is enforced). When a signal is bound to an ancestor of that path, notification re-reads the array and clones it with [...val] — a spread that iterates the full logical length, materializing a dense array with undefined holes. A single updateDataModel at index 10,000,000 with one bound /items signal costs ~0.5 s of pure cloning; at index 1e9 it is an out-of-memory crash. The control (same write, no bound signal) is instantaneous, isolating the clone as the defect. |
|---|
| स्रोत | ⚠️ https://github.com/a2ui-project/a2ui/issues/2386 |
|---|
| उपयोगकर्ता | ez-lbz (UID 87033) |
|---|
| सबमिशन | 06/10/2026 08:53 AM (22 दिन पहले) |
|---|
| संयम | 27/10/2026 09:56 PM (22 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 427571 [a2ui-project a2ui तक 0.10.6 data-model.ts DataModel.set सेवा अस्वीकार] |
|---|
| अंक | 20 |
|---|