Information Disclosure Vulnerability in a2ui Model Processor by a2ui-project
CVE-2026-92357

5.3MEDIUM

Key Information:

Vendor

A2ui-project

Status
A2ui
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92357?

A security vulnerability in the a2ui project's Model Processor component allows for information disclosure due to improper handling of the 'current[segment]' argument within the file model-processor.ts. This flaw can be exploited remotely, potentially exposing sensitive data. Users are advised to implement the available patches to mitigate the risk associated with this vulnerability.

Affected Version(s)

a2ui 0.8

a2ui 0.9

a2ui 1.0

References

https://vuldb.com/vuln/405444
vdb-entrytechnical-description
https://vuldb.com/vuln/405444/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-92357
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

colorfullbz (VulDB User)
.