The Root.renderComponentTree function in a2ui up to version 0.12.0 processes component trees and can incorporate dynamically-determined object attributes based on user input. An attacker can manipulate the attributes passed to this function, causing undefined or unexpected properties to be set on objects that are later used by the application. This flaw can lead to unintended behavior or privilege escalation if the manipulated attributes influence internal logic or configuration, and the description indicates that the attack may be launched remotely.

The vulnerability affects the a2ui-project a2ui component. Specifically, all releases up to and including 0.12.0 are impacted. The flaw resides in src/0.8/ui/root.js, within the Renderer implementation used by applications that incorporate a2ui at any version prior to the patch.

The CVSS score of 5.1 places this issue in the medium severity range. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating limited publicly known exploitation. The attack vector is inferred to be remote, as the description states the attack may be launched remotely, possibly through exposed UI endpoints or API calls that accept component definitions. The risk is moderate but could be increased if the affected component is part of a critical application exposed to external users.