Information Exposure Vulnerability in a2ui by a2ui-project
CVE-2026-118272

5.3MEDIUM

Key Information:

Vendor: A2ui-project
Status: A2ui
Vendor: CVE Published:; 28 October 2026

🔔 Create A2ui-project Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-118272?

The a2ui application up to version 0.10.6 contains a vulnerability within the Error Handler component, specifically in the DataContext.dispatchExpressionError function. This flaw leads to information exposure through detailed error messages, which can potentially divulge sensitive data to attackers. The vulnerability allows for remote attacks, making it critical for users to apply the provided patch (commit 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01) to mitigate the risk of exploitation. For detailed technical insights, you can refer to the relevant documentation and issue tracking on GitHub.

Affected Version(s)

a2ui 0.10.0

a2ui 0.10.1

a2ui 0.10.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-118272 - Proof of Concept