Dynamically Determined Object Attributes in a2ui Renderer by a2ui Project

CVE-2026-118538

What is CVE-2026-118538?

A security vulnerability has been identified in the a2ui application, specifically affecting the Renderer component's Root.renderComponentTree function in the src/0.8/ui/root.js file. This issue allows for the manipulation of dynamically determined object attributes, which can be exploited remotely by an attacker. The vulnerability poses risks of unauthorized access and potential exploitation of the application’s functionality. A pull request has been submitted to address this issue, highlighting the urgency of a timely fix.

References