EUVD-2026-80072
GHSA-fppw-pj6p-xrwh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote.
AnalysisAI
Cross-site scripting in the a2a-chat-canvas markdown rendering component of a2ui (a2ui-project) up to version 0.10.7 allows a low-privileged authenticated user to plant script that executes in another user's browser when the chat canvas renders the crafted content. The defect lives in samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts, where markdown is converted to HTML without fully neutralizing dangerous markup, yielding an integrity/behavior impact (VI:L) rather than data disclosure (VC:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in the a2ui agent SDK's FileResolver (a2ui 0.10.0 through 0.10.7) allows a remote, unauthent
Information disclosure in the a2ui agent-to-UI rendering library (versions 0.8, 0.9, and 1.0) lets a caller that can dri
Resource exhaustion in the a2ui component framework versions 0.9 and 0.9.1 allows remote attackers with low-privilege au
Mass assignment (CWE-915) in the a2ui message-processing component lets an authenticated remote attacker inject arbitrar
Open redirect in the A2UI web rendering library (a2ui-project a2ui) through version 0.10.7 lets an attacker craft a URL
CSS injection in the A2UI Angular Renderer (a2ui-project/a2ui through 0.10.6) lets a party who controls server-to-client
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today