| शीर्षक | a2ui-project a2ui 0.10.6 CWE-20 |
|---|
| विवरण | processMessages never parses the incoming message envelope against the v0.9 JSON schema (in contrast, the v0_8 model-processor.ts:110 does parse). Additionally, components with types not present in any catalog skip property validation but are still committed to the components model and trigger onCreated events.
The three current renderers render unknown component types as nothing, so there is no direct exploit path today. The issue is a defense-in-depth gap: any current or future consumer of componentsModel inherits fully unvalidated agent-controlled properties. |
|---|
| स्रोत | ⚠️ https://github.com/a2ui-project/a2ui/issues/2297 |
|---|
| उपयोगकर्ता | colorfullbz (UID 86308) |
|---|
| सबमिशन | 17/08/2026 03:33 PM (1 महीना पहले) |
|---|
| संयम | 15/09/2026 08:29 PM (29 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 404462 [a2ui-project a2ui तक 0.10.6 Message Parsing message-processor.ts processMessages अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|