a2ui CVE-2026-118273

Exploitation requires the ability to invoke DataModel.set with an attacker-influenced path (consistent with PR:L) and then supplying a numeric path segment whose array index exceeds the real array size - e.g. '/items/999999999' or '/newArray/10000000/field' - so that array auto-vivification or the array clone in set() allocates an enormous array, causing out-of-memory or a hung thread (confirmed by the fix adding a 10000-index cap). Limiting factors: it affects only the a2ui web_core v0.9 state module (data-model.ts) in versions up to 0.10.6; the impact is limited to client-side availability (VA:L - renderer memory/hang) with no confidentiality or integrity effect; and it requires low-privilege access to submit data-model paths rather than being fully unauthenticated.

This is a low-severity, low-priority issue, and the available signals are internally consistent rather than conflicting. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) describes a remotely reachable, low-complexity flaw that requires some privilege (PR:L) and produces only a low availability impact with no confidentiality or integrity loss - consistent with the base score of 2.1 and CWE-400 (uncontrolled resource consumption). The vuln.today decision label is 'monitor', there is no CISA KEV listing, and no EPSS score was provided in the input, so there is no signal of active or widespread exploitation. The only exploit signal is a GitHub issue reference (#2386); it is a public PoC reference and is not verified as working exploit code, which must not be conflated with active exploitation. Unusually for a VulDB-sourced entry, the actual trigger mechanism IS documented here by the vendor source diff: the fix (commit 82789191) adds a MAX_ARRAY_INDEX=10000 guard in DataModel.set, confirming the flaw is an unbounded array index that forces huge array auto-vivification/cloning and leads to memory exhaustion or a hung thread. Net: a genuine but minor client-side availability bug, correctly rated low; patch it on a normal maintenance cadence rather than as an emergency.

A low-privileged actor able to submit data-model updates to an a2ui web_core renderer calls DataModel.set with a path containing an enormous numeric array index, such as '/items/999999999'. The renderer attempts to auto-vivify/expand and clone the array to that index, exhausting memory or hanging the thread and degrading availability. A public PoC reference exists (GitHub issue #2386); it is not verified as working exploit code.