a2ui CVE-2026-118538

Exploitation requires the custom-element rendering path to be active - the reproduction in PR 3107 sets enableCustomElements = true on the a2ui-root before the crafted childComponents are rendered - and requires that the attacker can influence the component tree / property map consumed by Root.renderComponentTree. Limiting factors matching the CVSS 4.0 vector: PR:L means the attacker needs some privilege or trusted position to supply the component data (not fully anonymous), and UI:P means a user must render/view the attacker-influenced surface for the injected sink to fire. Impact is confined to the viewing page (no subsequent-system scope), and a deployment that never enables custom elements or never renders untrusted component properties is not exposed. No fully-merged vendor fix exists yet.

Signals point to a genuine but moderate-priority issue rather than an urgent one. The input CVSS 4.0 base score is 5.1 (medium) with AV:N/AC:L/AT:N/PR:L/UI:P and uniformly Low impact (VC:L/VI:L/VA:L, no subsequent-system impact), and vuln.today's decision label is 'this_month' - not act_now or emergency. There is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or probable mass exploitation; absence of EPSS here is a data gap, not a low-risk signal. No reference is labeled as working exploit code - the GitHub and VulDB links are an advisory, an issue, and the fix pull request - so this should be treated as no public exploit identified at time of analysis. The vendor fix is NOT yet in place: the pull request (PR 3107) awaits acceptance, so affected deployments cannot fully remediate by updating yet. Net: a real, confirmed code-level flaw (property/attribute filtering is absent in the custom-element render path) with limited blast radius and no demonstrated exploitation - worth remediating this cycle, consistent with the 'this_month' label, but not an emergency.

An agent or data source feeding the A2UI renderer supplies a component tree in which a custom component's 'properties' map includes dangerous DOM sinks (for example innerHTML, onclick, onerror, src, href, srcdoc). Because Root.renderComponentTree assigns these dynamically-determined attributes onto the custom element without restricting them to schema-allowed, exposed properties, the sink is set and runs in the viewing user's page context when the UI is rendered, enabling script injection and limited information disclosure. No public exploit code was identified; the fix PR's test suite demonstrates the exact blocked properties, confirming the mechanism.