A2UI CVE-2026-118537

Requires that the a2ui client (<= 0.10.4) render an Image, Video, or Audio player component whose 'url' value is attacker-influenced - i.e., sourced from an untrusted or compromised A2UI message/content provider - and that a user view the rendered surface (passive interaction, UI:P). Exploitation is limited by: (1) the need for the attacker to control or inject the component 'url', (2) the low-confidentiality-only impact (VC:L; no integrity or availability effect), and (3) the specific disallowed schemes the fix targets (javascript:, vbscript:, file:, blob:, and protocol-relative //), while data: URLs remain intentionally permitted. The javascript:/vbscript: schemes are among the blocked values in the PR tests; the available sources do not establish script execution in these media src contexts, so impact should be treated as the stated low-confidentiality resource-loading/disclosure rather than code execution.

This is a genuine but low-to-moderate priority issue, not a top-tier emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L, base 5.3 Medium) describes a network-reachable, low-complexity flaw with no privileges but requiring passive user interaction (UI:P) and yielding only low confidentiality impact (VC:L) with no integrity or availability effect. The SSVC/vuln.today Decision label is 'this_month', consistent with a Medium severity rather than act_now/emergency. The flaw is NOT in CISA KEV, so there is no confirmed active exploitation. No EPSS score was provided in the input, so exploitation probability cannot be quantified here - this is missing data, not a low score. No working exploit code is supplied; the references are a VulDB entry, a GitHub issue (#3077) and the fixing pull request (#3108), so this is 'no public exploit identified at time of analysis.' A notable conflict exists in the input: the Patch field states 'Available from vendor,' but the CVE description says 'the pull request to fix this issue awaits acceptance' and PR #3108 is the referenced fix - verify whether a fixed release actually exists versus only a pending/merged PR. Overall: a real, patch-track-worthy input-validation weakness with limited (low-confidentiality) impact and no evidence of widespread or active exploitation.

A malicious or compromised A2UI content source supplies an Image, Video, or Audio player component whose 'url' argument uses a disallowed scheme (e.g. file:///etc/passwd, a protocol-relative //evil.example.com/pixel.png, or a blob: URL). When a user views the rendered surface (UI:P), the pre-fix client places the unsanitized value directly into the media element's src attribute, enabling resource loading from unintended schemes and limited information disclosure. No public exploit is identified; the attack mechanism is inferred from the fixing PR #3108 test cases rather than a released PoC.