CVE-2026-92215mediumCWE-918

CVE-2026-92215: falha de média gravidade em a2ui-project a2ui

a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery

Publicada em

Seguir esta CVE+ Monitorar a2ui

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.5%
A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py of the component FileResolver. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The identifier of the patch is 2bb8423060308bbdea8ba468dabed4fc256d18ea. To fix this issue, it is recommended to deploy a patch.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Produtos afetados
a2ui-project · a2ui
CVEs relacionadas — a2ui-project a2ui

No mesmo produto, das mais perigosas para as menos.

CVE-2026-92114MEDIUMa2ui-project a2ui Basic Catalog safe_regex.ts redosEPSS 0.7%CVE-2026-92356MEDIUMa2ui-project a2ui Update Components basic_functions.ts updateComponents resource consumptionEPSS 0.5%CVE-2026-92216MEDIUMa2ui-project a2ui Binder generic-binder.ts openUrl redirectEPSS 0.5%CVE-2026-92217MEDIUMa2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributesEPSS 0.4%CVE-2026-118275MEDIUMa2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumptionEPSS 0.4%CVE-2026-92357MEDIUMa2ui-project a2ui Model Processor model-processor.ts information disclosureEPSS 0.4%