CVE-2026-92357mediumCWE-200CWE-284

CVE-2026-92357: falha de média gravidade em a2ui-project a2ui

a2ui-project a2ui Model Processor model-processor.ts information disclosure

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar a2ui

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.4%
A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument current[segment] leads to information disclosure. The attack may be initiated remotely. The identifier of the patch is 1b3bff234661ce922cbc3771be642b23ec9fd0fa. To fix this issue, it is recommended to deploy a patch.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Produtos afetados
a2ui-project · a2ui
CVEs relacionadas — a2ui-project a2ui

No mesmo produto, das mais perigosas para as menos.

CVE-2026-92114MEDIUMa2ui-project a2ui Basic Catalog safe_regex.ts redosEPSS 0.7%CVE-2026-92356MEDIUMa2ui-project a2ui Update Components basic_functions.ts updateComponents resource consumptionEPSS 0.5%CVE-2026-92215MEDIUMa2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgeryEPSS 0.5%CVE-2026-92216MEDIUMa2ui-project a2ui Binder generic-binder.ts openUrl redirectEPSS 0.5%CVE-2026-92217MEDIUMa2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributesEPSS 0.4%CVE-2026-118275MEDIUMa2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumptionEPSS 0.4%