EUVD-2026-80393
GHSA-wjg4-544x-cv2w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remotely reachable (AV:N/AC:L) but the vendor indicates authenticated access (PR:L); impact is limited resource-consumption availability degradation only (A:L), no C/I impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component Update Components. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Resource exhaustion in the a2ui component framework versions 0.9 and 0.9.1 allows remote attackers with low-privilege authenticated access to degrade availability by invoking the updateComponents function of basic_functions.ts with manipulated input. Impact is confined to a low availability effect (VA:L) with no confidentiality or integrity loss, and the vendor was notified through a public issue report but has not responded or produced a fix. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reach to an a2ui 0.9 or 0.9.1 instance plus low-level authenticated access (PR:L), then the ability to invoke the updateComponents function of basic_functions.ts with manipulated input. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-to-moderate real-world risk despite the CVSS 4.0 base score of 5.3. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis: the project was informed of the problem early through the public GitHub issue https://github.com/a2ui-project/a2ui/issues/2298 but has not responded, so no fixed version number can be cited and no upgrade target exists. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in the a2ui agent SDK's FileResolver (a2ui 0.10.0 through 0.10.7) allows a remote, unauthent
Information disclosure in the a2ui agent-to-UI rendering library (versions 0.8, 0.9, and 1.0) lets a caller that can dri
Mass assignment (CWE-915) in the a2ui message-processing component lets an authenticated remote attacker inject arbitrar
Open redirect in the A2UI web rendering library (a2ui-project a2ui) through version 0.10.7 lets an attacker craft a URL
Cross-site scripting in the a2a-chat-canvas markdown rendering component of a2ui (a2ui-project) up to version 0.10.7 all
CSS injection in the A2UI Angular Renderer (a2ui-project/a2ui through 0.10.6) lets a party who controls server-to-client
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today