Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

a2ui — Vulnerabilities & Security Advisories 16

All 16 CVE vulnerabilities found in a2ui, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities specific to the a2ui product, focusing on common software weaknesses and associated risk tags. The collection encompasses a comprehensive range of reported issues, including code injection flaws, privilege escalation vectors, and configuration errors, spanning the product's entire public release history from its initial launch to the current version. Visitors can utilize this resource to track official advisories issued by the vendor, analyze the prevalence and impact of specific weakness classes within the a2ui ecosystem, or review the complete vulnerability timeline for this particular software. The data is compiled from multiple trusted sources to ensure accuracy and timeliness, offering a centralized view of known security gaps without requiring external cross-referencing. By examining the aggregated records, security professionals and developers can identify patterns in how vulnerabilities have evolved over time and assess the effectiveness of past remediation efforts. This repository serves as a factual reference for audit planning, risk assessment, and security hardening strategies tailored to the a2ui environment. All entries are presented in a standardized format to facilitate quick analysis and integration into broader vulnerability management workflows.

Vendor: a2ui-project

CVE ID Title CVSS Severity Published
CVE-2026-118538 a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes CWE-915 5.5 Medium 2026-10-28
CVE-2026-118537 a2ui Image Player/Video Player/Audio Player Image.js input validation CWE-20 4.3 Medium 2026-10-28
CVE-2026-118276 a2ui-project a2ui Parser expression_parser.ts formatString resource consumption CWE-400 3.5 Low 2026-10-28
CVE-2026-118275 a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption CWE-400 5.3 Medium 2026-10-28
CVE-2026-118274 a2ui-project a2ui Binder generic-binder.ts resource consumption CWE-400 4.3 Medium 2026-10-28
CVE-2026-118273 a2ui-project a2ui data-model.ts DataModel.set resource consumption CWE-400 4.3 Medium 2026-10-28
CVE-2026-118272 a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure CWE-209 4.3 Medium 2026-10-28
CVE-2026-118271 a2ui-project a2ui data-context Resolver data-context.ts resource consumption CWE-400 4.3 Medium 2026-10-28
CVE-2026-92357 a2ui-project a2ui Model Processor model-processor.ts information disclosure CWE-200 4.3 Medium 2026-09-16
CVE-2026-92356 a2ui-project a2ui Update Components basic_functions.ts updateComponents resource consumption CWE-400 4.3 Medium 2026-09-16
CVE-2026-92217 a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes CWE-915 6.3 Medium 2026-09-16
CVE-2026-92216 a2ui-project a2ui Binder generic-binder.ts openUrl redirect CWE-601 4.3 Medium 2026-09-16
CVE-2026-92215 a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery CWE-918 7.3 High 2026-09-16
CVE-2026-92214 a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting CWE-79 3.5 Low 2026-09-16
CVE-2026-92213 a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection CWE-74 5.5 Medium 2026-09-16
CVE-2026-92114 a2ui-project a2ui Basic Catalog safe_regex.ts redos CWE-1333 5.3 Medium 2026-09-15

All 16 known CVE vulnerabilities affecting a2ui with full Chinese analysis, references, and POCs where available.