CVE-2026-118272
Received
Received - Intake
Information Exposure in a2ui up to 0.10.6
Vulnerability report for CVE-2026-118272, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-28
Last updated on: 2026-10-28
Assigner: VulDB
Description
Description
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error message. It is possible to initiate the attack remotely. The exploit is now public and may be used. The patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01. It is suggested to install a patch to address this issue.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| a2ui-project | a2ui | 0.10.0 |
| a2ui-project | a2ui | 0.10.1 |
| a2ui-project | a2ui | 0.10.2 |
| a2ui-project | a2ui | 0.10.3 |
| a2ui-project | a2ui | 0.10.4 |
| a2ui-project | a2ui | 0.10.5 |
| a2ui-project | a2ui | 0.10.6 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-209 | The product generates an error message that includes sensitive information about its environment, users, or associated data. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
