| शीर्षक | a2ui-project a2ui <=0.10.6 CWE-400 |
|---|
| विवरण | A ChildList written as {componentId, path} binds a container's children to a data-model array. The binder's STRUCTURAL branch subscribes to that path and, on every change, maps the entire array into child descriptors and clones them into the props tree — with no cap on the array length. One small component (a Column with a child-list template) plus one data write at the bound path materializes as many children as the array is long. This is distinct from the unbounded component arrays reported earlier in the first advisory batch (F-08, item 1): there the payload itself is a huge component array; here two components and one data write amplify through the binder, so a components-per-message cap does not mitigate it. |
|---|
| स्रोत | ⚠️ https://github.com/a2ui-project/a2ui/issues/2387 |
|---|
| उपयोगकर्ता | ez-lbz (UID 87033) |
|---|
| सबमिशन | 06/10/2026 08:55 AM (22 दिन पहले) |
|---|
| संयम | 27/10/2026 09:56 PM (22 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 427572 [a2ui-project a2ui तक 0.10.6 Binder generic-binder.ts सेवा अस्वीकार] |
|---|
| अंक | 20 |
|---|