CVE-2026-92213
MediumCVSS 5.5Summary
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible to be carried out remotely. The patch is named fb8e85aec78d04e81feb9992a57638ca1ec4dc1b. It is suggested to install a patch to address this issue.
Risk Assessment
Injection may allow an attacker to execute malicious code or manipulate data within the application context, potentially leading to session hijacking or data leakage. The vulnerability is remotely exploitable.
Recommendation
Immediately apply the patch identified as fb8e85aec78d04e81feb9992a57638ca1ec4dc1b by updating a2ui to a version containing this fix.
Other vulnerabilities in a2ui
See all- CVE-2026-92217Medium
A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/web_core/src/v0_9/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
- CVE-2026-92216Medium
A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
- CVE-2026-92215High
A vulnerability has been found in the a2ui project (up to version 0.10.7) in the httpx.get function of file_resolver.py within the FileResolver component. Input manipulation leads to Server-Side Request Forgery (SSRF). The attack can be launched remotely, and the patch is identified by 2bb8423060308bbdea8ba468dabed4fc256d18ea.
- CVE-2026-92214Low
A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote.
- CVE-2026-92114Medium
A vulnerability was identified in a2ui-project a2ui up to 0.10.6, affecting an unknown function in renderers/web_core/src/v0_9/basic_catalog/functions/safe_regex.ts within the Basic Catalog component. The manipulation leads to inefficient regular expression complexity and can be triggered remotely.
Original NVD description (English source)
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible to be carried out remotely. The patch is named fb8e85aec78d04e81feb9992a57638ca1ec4dc1b. It is suggested to install a patch to address this issue.