EUVD-2026-111570
GHSA-hxwv-qhw4-49vx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to a2ui-based app
-
ExploitSubmit input causing expression error
-
ExecutionError handler attaches V8 stack to details
-
ImpactRead leaked file paths and internals
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Error message sanitization
MITRE ATT&CK
1 technique across 1 tactic: Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker who can cause the a2ui web_core renderer's expression evaluation to throw - for example by supplying a dynamic value/function call with invalid arguments (the diff cites a RangeError from toFixed with an out-of-range 'decimals' argument). Before the patch, DataContext.dispatchExpressionError populated the dispatched error's 'details' field with 'e.stack', so the raw V8 stack trace (which can contain internal file-system paths) was returned to the caller. Limiting factors: the CVSS vector specifies PR:L, so low-privilege authenticated access is required; impact is confined to confidentiality of internal error detail (VC:L) with no integrity or availability effect; affected versions are a2ui 0.10.0 through 0.10.6, and updating to the patched build is the fix. |
| Impact | This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with only VC:L and no integrity or availability impact yields a base score of 2.1, reflecting a minor confidentiality-only information-disclosure flaw (CWE-209). The vuln.today decision label is 'monitor,' there is no CISA KEV listing, and no EPSS score was supplied. The CVSS 4.0 exploit-maturity metric E:P (proof-of-concept) aligns with the intelligence that a public PoC reference exists but is not verified as working exploit code - these two signals agree. PR:L means exploitation requires at least low-privilege authenticated access, which further caps real-world urgency. The only thing being exposed is internal error detail (V8 stack traces that may contain file-system paths), not credentials or code execution. No signals conflict; this is a low-CVSS, low-real-risk hardening fix rather than an emergency. EPSS is absent, so widespread-exploitation probability cannot be independently quantified. |
| Exploit ScenarioDerived | An authenticated low-privilege user of an application built on the a2ui web renderer submits input that triggers an expression-evaluation error (for example, a function call with out-of-range arguments producing a RangeError). The error handler's dispatchExpressionError attaches the raw V8 stack trace to the dispatched error's details field, exposing internal file-system paths and implementation structure to the caller. A public PoC reference exists (GitHub issue #2385) but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
a2ui 0.10.0 through 0.10.6 leaks stack traces and internal file-system paths through expression-error messages: the web_core renderer's DataContext.dispatchExpressionError copied the raw V8 'e.stack' into the 'details' field of the dispatched error instead of returning only a sanitized message. An attacker who can make expression evaluation throw (for example a dynamic value calling formatNumber with an out-of-range 'decimals' argument that raises a RangeError) can read the returned stack detail remotely; the CVSS 4.0 score is 2.1 (assessed CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so confidentiality of internal error detail is the only impact, with low-privileged authenticated access required. A public PoC reference exists in issue #2385 but is not verified as working exploit code, no CISA KEV entry indicates active exploitation, and the vendor patch is available in commit 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01.
RemediationAI
Vendor-released patch: commit 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01, merged as pull request https://github.com/a2ui-project/a2ui/pull/2429. Update the a2ui web_core renderer to a build that contains that commit, replacing the 0.10.0-0.10.6 release you are running; verify after upgrading that dispatched expression errors no longer include a 'details' object with a stack value. If upgrading is not immediately possible, the exposure is confined to error objects surfaced to consumers of DataContext, so ensure only trusted, low-privilege-authenticated users can drive expression evaluation (matching the PR:L requirement) and avoid rendering raw dispatched error 'details' into client-visible output or logs that reach untrusted parties - these are partial compensations only, and the vendor's fix is the complete remediation since the flaw is that the error object itself carries the stack trace.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
a2ui is a Google/community project for agent-driven UI rendering, and the affected code lives in renderers/web_core/src/v0_9/rendering/data-context.ts, a TypeScript module that resolves dynamic values and expression function calls (such as formatNumber) inside a DataContext. When an invoked function throws, dispatchExpressionError builds an error object with a code of 'EXPRESSION_ERROR', the expression name, and a message; before the fix it also attached details: {stack: e.stack}. Because JavaScript/V8 stack traces include absolute file paths and internal module locations, this is a textbook CWE-209 (Generation of Error Message Containing Sensitive Information) exposure in an error-handling component. The patch removes the details field, switches the message access to optional chaining (e?.message) so thrown null/undefined values no longer crash the handler, and adds tests asserting details is undefined and that a RangeError from toFixed with out-of-range digits still yields a sanitized message.
Know when A2Ui gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Remotely reachable renderer error path (AV:N/AC:L) needing low-privilege access (PR:L); only internal stack-trace paths leak, so C:L with I:N/A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error message. It is possible to initiate the attack remotely. The exploit is now public and may be used. The patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01. It is suggested to install a patch to address this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in a2ui-project a2ui Resource Exhaustion Vulnerabilities
View all 6Server-side request forgery in the a2ui agent SDK's FileResolver (a2ui 0.10.0 through 0.10.7) allows a remote, unauthent
Open redirect in the A2UI web rendering library (a2ui-project a2ui) through version 0.10.7 lets an attacker craft a URL
Resource exhaustion in the a2ui component framework versions 0.9 and 0.9.1 allows remote attackers with low-privilege au
Mass assignment (CWE-915) in the a2ui message-processing component lets an authenticated remote attacker inject arbitrar
Information disclosure in the a2ui agent-to-UI rendering library (versions 0.8, 0.9, and 1.0) lets a caller that can dri
Improper URL validation in A2UI's Image, Video and Audio player components (versions up to and including 0.10.4) lets an
Cross-site scripting in the a2a-chat-canvas markdown rendering component of a2ui (a2ui-project) up to version 0.10.7 all
Exploit-DB