CVE-2026-118272 - Vulnerability Details

- a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure

Description

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error message. It is possible to initiate the attack remotely. The exploit is now public and may be used. The patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01. It is suggested to install a patch to address this issue.

Published: 2026-10-28

Score: 5.3 Medium

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

A2UI exposes sensitive application details through the DataContext.dispatchExpressionError function in its web core renderer. When the error handler is invoked, unfiltered error information is returned to the client. This flaw aligns with CWE-200 (Information Exposure) and CWE-209 (Improper Error Handling). The resulting vulnerability allows an attacker to learn internal state or configuration details, which can be leveraged for further attacks.

Affected Systems

The issue affects a2ui-project a2ui versions up to 0.10.6. The fix is implemented in the commit 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01. Users who are running 0.10.6 or earlier and have not applied the commit or upgraded to a newer release are vulnerable.

Risk and Exploitability

The CVSS v3 score is 5.3, indicating a moderate severity. External exploitation is possible as the error is triggered remotely. The EPSS score is unavailable, but the vulnerability is publicly disclosed and could be abused. The attack vector is inferred to be a remote request that causes the error handler to fire, thereby leaking the error message to the requester. The vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

a2ui-project

a2ui

affected

Version	Status	Constraints
`0.10.0`	affected	—
`0.10.1`	affected	—
`0.10.2`	affected	—
`0.10.3`	affected	—
`0.10.4`	affected	—
`0.10.5`	affected	—
`0.10.6`	affected	—

No data.

Vendor Product Confidence Versions

A2ui-project

A2ui

95%

Version	Status	Scheme	Platform
`0.10.0`	affected	semver	—
`0.10.1`	affected	semver	—
`0.10.2`	affected	semver	—
`0.10.3`	affected	semver	—
`0.10.4`	affected	semver	—
`0.10.5`	affected	semver	—
`0.10.6`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the patch provided in commit 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01, or upgrade a2ui to a version newer than 0.10.6 that contains the fix.
As a temporary workaround, configure the application to suppress detailed error information in production environments or disable the component that exposes DataContext.dispatchExpressionError until the patch is applied.
If the application must remain exposed, limit the permissions of the process that runs the error handler, reducing the impact of any exposed data.

Generated by OpenCVE AI on October 28, 2026 at 03:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/a2ui-project/a2ui/
https://github.com/a2ui-project/a2ui/commit/8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01
https://github.com/a2ui-project/a2ui/issues/2385
https://github.com/a2ui-project/a2ui/pull/2429
https://vuldb.com/cve/CVE-2026-118272
https://vuldb.com/submit/1015116
https://vuldb.com/vuln/427570
https://vuldb.com/vuln/427570/cti

History

Wed, 28 Oct 2026 02:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error message. It is possible to initiate the attack remotely. The exploit is now public and may be used. The patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01. It is suggested to install a patch to address this issue.
Title		a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure
First Time appeared		A2ui-project A2ui-project a2ui
Weaknesses		CWE-200 CWE-209
CPEs		cpe:2.3:a:a2ui-project:a2ui::::::::
Vendors & Products		A2ui-project A2ui-project a2ui
References		https://github.com/a2ui-project/a2ui/ https://github.com/a2ui-project/a2ui/commit/8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01 https://github.com/a2ui-project/a2ui/issues/2385 https://github.com/a2ui-project/a2ui/pull/2429 https://vuldb.com/cve/CVE-2026-118272 https://vuldb.com/submit/1015116 https://vuldb.com/vuln/427570 https://vuldb.com/vuln/427570/cti
Metrics		cvssV2_0 `{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

A2ui-project A2ui

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-28T02:00:21.447Z

Updated: 2026-10-28T02:00:21.447Z

Reserved: 2026-10-27T20:55:49.052Z

Link: CVE-2026-118272

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-28T02:17:07.497

Modified: 2026-10-28T02:17:07.497

Link: CVE-2026-118272

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-28T04:00:09Z

Weaknesses

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-209
Generation of Error Message Containing Sensitive Information

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object