| Название | a2ui-project a2ui <=0.10.6 CWE-209 |
|---|
| Описание | When a bound function call throws, DataContext.dispatchExpressionError handles ZodError and A2uiExpressionError specially, but for any other error it attaches details: { stack: e.stack } — the complete V8 stack, including internal source paths and line numbers of the SDK itself. SurfaceModel.onError (an EventEmitter) forwards these detail objects to every subscriber, so a server-driven binding that triggers a native error (e.g. formatNumber with decimals: 200 raising RangeError from Number.prototype.toFixed) leaks the client's internal stack into whatever the host application logs or renders for surface errors. |
|---|
| Источник | ⚠️ https://github.com/a2ui-project/a2ui/issues/2385 |
|---|
| Пользователь | ez-lbz (UID 87033) |
|---|
| Представление | 06.10.2026 08:52 (22 дни назад) |
|---|
| Модерация | 27.10.2026 21:56 (22 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 427570 [a2ui-project a2ui до 0.10.6 Error data-context.ts DataContext.dispatchExpressionError раскрытие информации] |
|---|
| Баллы | 20 |
|---|