CVE-2026-92213 - Vulnerability Details

- a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection

Description

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible to be carried out remotely. The patch is named fb8e85aec78d04e81feb9992a57638ca1ec4dc1b. It is suggested to install a patch to address this issue.

Published: 2026-09-16

Score: 5.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A2UI's Angular Renderer is vulnerable through its A manipulation of the primaryColor argument allows an attacker to inject arbitrary content, leading to potential code execution or other malicious payloads. The flaw is an injection vulnerability, as indicated by the CWE identifiers 707 and 74.

Affected Systems

The vulnerability affects a2ui-project's a2ui component up to version 0.10.6. It is present in the Angular Renderer’s server‑to‑client code and is patched in the commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b.

Risk and Exploitability

The CVSS v3.1 score of 5.1 classifies the flaw as moderately severe. The EPSS score of less than 1% suggests a low exploitation probability, and the vulnerability is not currently listed in the CISA KEV catalogue. Attacks are possible remotely, implying that any system exposing the Angular Renderer could be targeted.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

a2ui-project

a2ui

affected

Version	Status	Constraints
`0.10.0`	affected	—
`0.10.1`	affected	—
`0.10.2`	affected	—
`0.10.3`	affected	—
`0.10.4`	affected	—
`0.10.5`	affected	—
`0.10.6`	affected	—

No data.

Vendor Product Confidence Versions

A2ui-project

A2ui

95%

Version	Status	Scheme	Platform
`0.10.0`	affected	semver	—
`0.10.1`	affected	semver	—
`0.10.2`	affected	semver	—
`0.10.3`	affected	semver	—
`0.10.4`	affected	semver	—
`0.10.5`	affected	semver	—
`0.10.6`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the official patch from commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b or upgrade to a version newer than 0.10.6.
Configure or validate the primaryColor input to enforce whitelisting of allowed color values, preventing arbitrary injection at runtime.
Monitor application logs for abnormal usage of primaryColor or unexpected injection attempts, and ensure that updates are applied promptly.

Generated by OpenCVE AI on September 16, 2026 at 17:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00236.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/a2ui-project/a2ui/
https://github.com/a2ui-project/a2ui/commit/fb8e85aec78d04e81feb9992a57638ca1ec4dc1b
https://github.com/a2ui-project/a2ui/issues/2293
https://github.com/a2ui-project/a2ui/pull/2367
https://vuldb.com/cve/CVE-2026-92213
https://vuldb.com/submit/934101
https://vuldb.com/vuln/404458
https://vuldb.com/vuln/404458/cti

History

Wed, 16 Sep 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 16 Sep 2026 01:00:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible to be carried out remotely. The patch is named fb8e85aec78d04e81feb9992a57638ca1ec4dc1b. It is suggested to install a patch to address this issue.
Title		a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection
First Time appeared		A2ui-project A2ui-project a2ui
Weaknesses		CWE-707 CWE-74
CPEs		cpe:2.3:a:a2ui-project:a2ui::::::::
Vendors & Products		A2ui-project A2ui-project a2ui
References		https://github.com/a2ui-project/a2ui/ https://github.com/a2ui-project/a2ui/commit/fb8e85aec78d04e81feb9992a57638ca1ec4dc1b https://github.com/a2ui-project/a2ui/issues/2293 https://github.com/a2ui-project/a2ui/pull/2367 https://vuldb.com/cve/CVE-2026-92213 https://vuldb.com/submit/934101 https://vuldb.com/vuln/404458 https://vuldb.com/vuln/404458/cti
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}` cvssV3_0 `{'score': 5.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}` cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}` cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}`

Subscriptions

A2ui-project A2ui

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-16T00:00:24.104Z

Updated: 2026-09-16T19:39:32.440Z

Reserved: 2026-09-15T18:28:56.437Z

Link: CVE-2026-92213

Vulnrichment

Updated: 2026-09-16T19:39:29.216Z

NVD

Status : Deferred

Published: 2026-09-16T01:16:29.247

Modified: 2026-09-16T20:17:47.090

Link: CVE-2026-92213

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-16T17:45:17Z

Weaknesses

CWE-707
Improper Neutralization
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object