CVE-2026-118538

A vulnerability was found in a2ui up to 0.10.4 affecting unknown code in src/v0_9/basic_catalog/components/Image.js of the Image Player/Video Player/Audio Player component. Manipulation of the url argument results in improper input validation, the attack may be initiated remotely, and the pull request to fix this issue awaits acceptance.

A vulnerability was determined in a2ui up to 0.10.6 affecting the formatString function in expression_parser.ts of the Parser component. The manipulation causes resource consumption and can be initiated remotely. The exploit has been publicly disclosed and a patch is available as 1f71d1aac1b145ef57c7526f9e0cff316f5934e2.

A vulnerability was found in a2ui up to 0.10.6 affecting the DataContext.resolveSignal function in data-context.ts of the Resolver component. The manipulation results in resource consumption and can be triggered remotely. The exploit has been publicly disclosed and a patch is available as c76e17272e52c12c6dcf68905b1df978c39e9aa5.

a2ui up to 0.10.6 contains a vulnerability in unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the Binder component, leading to resource consumption. The attack can be initiated remotely, and the exploit has been publicly disclosed and may be used.

a2ui up to 0.10.6 contains a vulnerability in the DataModel.set function of the file renderers/web_core/src/v0_9/state/data-model.ts, leading to resource consumption. The attack can be launched remotely, and the exploit has been published and may be used.

In a2ui-project a2ui up to 0.10.6, the DataContext.dispatchExpressionError function in renderers/web_core/src/v0_9/rendering/data-context.ts (Error Handler component) exposes information through error messages. The vulnerability is remotely exploitable and a public exploit is available; the patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01.

In a2ui-project a2ui up to 0.10.6, a function in renderers/web_core/src/v0_9/rendering/data-context.ts (data-context Resolver component) allows resource consumption. The attack is remote and a public exploit has been disclosed; the patch is named eb314e14fabd29cfb4a74e1202afc4fe2081efa2.

A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument current[segment] leads to information disclosure. The attack may be initiated remotely. The identifier of the patch is 1b3bff234661ce922cbc3771be642b23ec9fd0fa. To fix this issue, it is recommended to deploy a patch.

A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component Update Components. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

A remote attacker with low privileges can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials, allowing execution of commands with root privileges on the device.