CVE-2026-92214— a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting
Quick assessment
Affected
a2ui-project a2ui
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 a2ui-project a2ui 版本 0.10.7 及以下版本中发现了一个安全漏洞。该漏洞影响组件 a2a-chat-canvas 中文件 的一个未知函数。通过特定操作可触发跨站脚本攻击（XSS），且该攻击可由远程发起。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92214
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| a2ui-project | a2ui | 0.10.0 |
cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-92214
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92214
请登录查看更多情报信息。
Other References for CVE-2026-92214 (1)
Same Patch Batch · a2ui-project · 2026-09-16 · 5 CVEs total
| CVE-2026-92215 | 7.3 HIGH | a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery |
| CVE-2026-92217 | 6.3 MEDIUM | a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determi |
| CVE-2026-92213 | 5.5 MEDIUM | a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection |
| CVE-2026-92216 | 4.3 MEDIUM | a2ui-project a2ui Binder generic-binder.ts openUrl redirect |
IV. Related Vulnerabilities
Same product: a2ui
-
CVE-2026-92217
a2ui-project a2ui Message Parsing message-processor.ts proce -
CVE-2026-92216
a2ui-project a2ui Binder generic-binder.ts openUrl redirect -
CVE-2026-92215
a2ui-project a2ui FileResolver file_resolver.py httpx.get se -
CVE-2026-92213
a2ui-project a2ui Angular Renderer server-to-client.ts z.any -
CVE-2026-92114
a2ui-project a2ui Basic Catalog safe_regex.ts redos
Same vendor: a2ui-project
-
CVE-2026-92217
a2ui-project a2ui Message Parsing message-processor.ts proce -
CVE-2026-92216
a2ui-project a2ui Binder generic-binder.ts openUrl redirect -
CVE-2026-92215
a2ui-project a2ui FileResolver file_resolver.py httpx.get se -
CVE-2026-92213
a2ui-project a2ui Angular Renderer server-to-client.ts z.any -
CVE-2026-92114
a2ui-project a2ui Basic Catalog safe_regex.ts redos
Same weakness: CWE-79
-
CVE-2026-18595
WP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cr -
CVE-2026-11996
Advanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cr -
CVE-2026-15639
Reflected Cross-Site Scripting -
CVE-2026-92257
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 -
CVE-2026-76872
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via D
V. Comments for CVE-2026-92214
No comments yet