A2Ui
Monthly
Information disclosure in the a2ui agent-to-UI rendering library (versions 0.8, 0.9, and 1.0) lets a caller that can drive an A2UI surface read JavaScript prototype-chain members - such as __proto__, constructor, toString, and valueOf - through the Model Processor's data-binding path resolver, leaking internal object structure rather than application data. The flaw is an unauthenticated-of-the-network-but-role-limited (CVSS PR:L) defect in model-processor.ts, where path segments are evaluated as current[segment] without an own-property check; impact is limited to low confidentiality loss with no integrity or availability effect, and there is no public exploit identified at time of analysis. Vendor risk is low-to-moderate: a fix exists upstream as commit 1b3bff23 (PR #2355), but no tagged patched release has been independently confirmed.
Resource exhaustion in the a2ui component framework versions 0.9 and 0.9.1 allows remote attackers with low-privilege authenticated access to degrade availability by invoking the updateComponents function of basic_functions.ts with manipulated input. Impact is confined to a low availability effect (VA:L) with no confidentiality or integrity loss, and the vendor was notified through a public issue report but has not responded or produced a fix. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because a2ui is a niche, early-version open-source project with minimal deployment, the practical risk is low to moderate despite the CVSS 4.0 base score of 5.3.
Mass assignment (CWE-915) in the a2ui message-processing component lets an authenticated remote attacker inject arbitrary, dynamically-determined object attributes by submitting crafted messages to the message processor, producing limited confidentiality, integrity and availability effects. All a2ui versions up to and including 0.10.6 are affected according to the CPE range, and the upstream maintainers have not responded to the reported issue (#2297), so no patched release exists. No public exploit code and no CISA KEV entry were identified at time of analysis; the EPSS probability was not supplied with the input data.
Open redirect in the A2UI web rendering library (a2ui-project a2ui) through version 0.10.7 lets an attacker craft a URL that the Binder component's openUrl handler forwards to the
Server-side request forgery in the a2ui agent SDK's FileResolver (a2ui 0.10.0 through 0.10.7) allows a remote, unauthenticated attacker to make the agent process issue attacker-influenced outbound HTTP requests via the httpx.get call in file_resolver.py, enabling access to internal services, cloud metadata endpoints, and other resources reachable from the agent host. Exploitation requires that the deployment actually uses the FileResolver extension's HTTP path and that an attacker can supply or influence the file reference (file_id/URL) the agent resolves; the impact is bounded to server-initiated requests rather than code execution, and the affected product's deployment footprint is very small. Vendor patching is available as an upstream commit/PR, and no public exploit code was identified at time of analysis; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (CVSS 4.0 base 6.9).
Cross-site scripting in the a2a-chat-canvas markdown rendering component of a2ui (a2ui-project) up to version 0.10.7 allows a low-privileged authenticated user to plant script that executes in another user's browser when the chat canvas renders the crafted content. The defect lives in samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts, where markdown is converted to HTML without fully neutralizing dangerous markup, yielding an integrity/behavior impact (VI:L) rather than data disclosure (VC:N). There is confirmed CISA KEV status: no active exploitation has been reported, no public exploit code exists, and tracking is currently handled through a public GitHub issue rather than a formal vendor security bulletin.
CSS injection in the A2UI Angular Renderer (a2ui-project/a2ui through 0.10.6) lets a party who controls server-to-client messages embed arbitrary strings in the theme.primaryColor field, which the renderer writes unvalidated into the host element's --a2ui-color-primary CSS custom property. Because the theme is declared with z.any() in renderers/web_core/src/v0_9/schema/server-to-client.ts, values such as url(https://attacker.example/beacon) bypass validation and reach the DOM style layer, enabling UI spoofing, outbound request beacons and potential data exfiltration from affected Angular applications. Exploitation requires the ability to inject or manipulate the message stream consumed by the renderer (PR:L) plus a passive user action (UI:P); the vendor has published fix commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b (PR #2367). There is no CISA KEV listing and no public exploit identified at time of analysis.
Information disclosure in the a2ui agent-to-UI rendering library (versions 0.8, 0.9, and 1.0) lets a caller that can drive an A2UI surface read JavaScript prototype-chain members - such as __proto__, constructor, toString, and valueOf - through the Model Processor's data-binding path resolver, leaking internal object structure rather than application data. The flaw is an unauthenticated-of-the-network-but-role-limited (CVSS PR:L) defect in model-processor.ts, where path segments are evaluated as current[segment] without an own-property check; impact is limited to low confidentiality loss with no integrity or availability effect, and there is no public exploit identified at time of analysis. Vendor risk is low-to-moderate: a fix exists upstream as commit 1b3bff23 (PR #2355), but no tagged patched release has been independently confirmed.
Resource exhaustion in the a2ui component framework versions 0.9 and 0.9.1 allows remote attackers with low-privilege authenticated access to degrade availability by invoking the updateComponents function of basic_functions.ts with manipulated input. Impact is confined to a low availability effect (VA:L) with no confidentiality or integrity loss, and the vendor was notified through a public issue report but has not responded or produced a fix. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because a2ui is a niche, early-version open-source project with minimal deployment, the practical risk is low to moderate despite the CVSS 4.0 base score of 5.3.
Mass assignment (CWE-915) in the a2ui message-processing component lets an authenticated remote attacker inject arbitrary, dynamically-determined object attributes by submitting crafted messages to the message processor, producing limited confidentiality, integrity and availability effects. All a2ui versions up to and including 0.10.6 are affected according to the CPE range, and the upstream maintainers have not responded to the reported issue (#2297), so no patched release exists. No public exploit code and no CISA KEV entry were identified at time of analysis; the EPSS probability was not supplied with the input data.
Open redirect in the A2UI web rendering library (a2ui-project a2ui) through version 0.10.7 lets an attacker craft a URL that the Binder component's openUrl handler forwards to the
Server-side request forgery in the a2ui agent SDK's FileResolver (a2ui 0.10.0 through 0.10.7) allows a remote, unauthenticated attacker to make the agent process issue attacker-influenced outbound HTTP requests via the httpx.get call in file_resolver.py, enabling access to internal services, cloud metadata endpoints, and other resources reachable from the agent host. Exploitation requires that the deployment actually uses the FileResolver extension's HTTP path and that an attacker can supply or influence the file reference (file_id/URL) the agent resolves; the impact is bounded to server-initiated requests rather than code execution, and the affected product's deployment footprint is very small. Vendor patching is available as an upstream commit/PR, and no public exploit code was identified at time of analysis; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (CVSS 4.0 base 6.9).
Cross-site scripting in the a2a-chat-canvas markdown rendering component of a2ui (a2ui-project) up to version 0.10.7 allows a low-privileged authenticated user to plant script that executes in another user's browser when the chat canvas renders the crafted content. The defect lives in samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts, where markdown is converted to HTML without fully neutralizing dangerous markup, yielding an integrity/behavior impact (VI:L) rather than data disclosure (VC:N). There is confirmed CISA KEV status: no active exploitation has been reported, no public exploit code exists, and tracking is currently handled through a public GitHub issue rather than a formal vendor security bulletin.
CSS injection in the A2UI Angular Renderer (a2ui-project/a2ui through 0.10.6) lets a party who controls server-to-client messages embed arbitrary strings in the theme.primaryColor field, which the renderer writes unvalidated into the host element's --a2ui-color-primary CSS custom property. Because the theme is declared with z.any() in renderers/web_core/src/v0_9/schema/server-to-client.ts, values such as url(https://attacker.example/beacon) bypass validation and reach the DOM style layer, enabling UI spoofing, outbound request beacons and potential data exfiltration from affected Angular applications. Exploitation requires the ability to inject or manipulate the message stream consumed by the renderer (PR:L) plus a passive user action (UI:P); the vendor has published fix commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b (PR #2367). There is no CISA KEV listing and no public exploit identified at time of analysis.