Information disclosure in A2ui-Project A2ui
CVE-2026-118272
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error message. It is possible to initiate the attack remotely. The exploit is now public and may be used. The patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01. It is suggested to install a patch to address this issue.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.002 (16.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 16th percentile — 16.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
- A2ui-Project A2ui — versions 0.10.0, 0.10.1, 0.10.2
Weakness classification (CWE)
References
- github.com/a2ui-project/a2ui/ (product)
- github.com/a2ui-project/a2ui/commit/8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01 (patch)
- github.com/a2ui-project/a2ui/issues/2385 (issue-tracking, exploit)
- github.com/a2ui-project/a2ui/pull/2429 (issue-tracking, patch)
- vuldb.com/cve/CVE-2026-118272 (third-party-advisory)
- vuldb.com/submit/1015116 (third-party-advisory)
- vuldb.com/vuln/427570 (technical-description, vdb-entry)
- vuldb.com/vuln/427570/cti (signature, permissions-required)
Frequently asked questions
- What is CVE-2026-118272?
- CVE-2026-118272 is a medium-severity vulnerability in A2ui-Project A2ui, classified under Information Disclosure. CVSS score: 4.3/10. Published 2026-10-28.
- How severe is CVE-2026-118272?
- Medium severity. CVSS v3 base score is 4.3 out of 10.