A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection.
The attack is possible to be carried out remotely. The patch is named fb8e85aec78d04e81feb9992a57638ca1ec4dc1b. It is suggested to install a patch to address this issue.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
a2ui-project:a2ui
References 8
https://github.com/a2ui-project/a2ui/
cna@vuldb.com
https://github.com/a2ui-project/a2ui/commit/fb8e85aec78d04e81feb9992a57638ca1ec…
cna@vuldb.com
https://github.com/a2ui-project/a2ui/issues/2293
cna@vuldb.com
https://github.com/a2ui-project/a2ui/pull/2367
cna@vuldb.com
https://vuldb.com/cve/CVE-2026-92213
cna@vuldb.com
https://vuldb.com/submit/934101
cna@vuldb.com
https://vuldb.com/vuln/404458
cna@vuldb.com
https://vuldb.com/vuln/404458/cti
cna@vuldb.com