CVE-2026-118538
Received
Received - Intake
Dynamically-Determined Object Attributes in a2ui
Vulnerability report for CVE-2026-118538, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-28
Last updated on: 2026-10-28
Assigner: VulDB
Description
Description
A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| a2ui-project | a2ui | 0.1 |
| a2ui-project | a2ui | 0.2 |
| a2ui-project | a2ui | 0.3 |
| a2ui-project | a2ui | 0.4 |
| a2ui-project | a2ui | 0.5 |
| a2ui-project | a2ui | 0.6 |
| a2ui-project | a2ui | 0.7 |
| a2ui-project | a2ui | 0.8 |
| a2ui-project | a2ui | 0.9 |
| a2ui-project | a2ui | 0.10 |
| a2ui-project | a2ui | 0.11 |
| a2ui-project | a2ui | 0.12.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-915 | The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. |
| CWE-913 | The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements. |
