What’s Vulnerable › Vulnerabilities

CVE-2026-92357: a2ui-project a2ui Model Processor model-processor.ts information disclosure

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-16 · updated 2026-09-28
• Weakness: CWE-200

Description

A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument current[segment] leads to information disclosure. The attack may be initiated remotely. The identifier of the patch is 1b3bff234661ce922cbc3771be642b23ec9fd0fa. To fix this issue, it is recommended to deploy a patch.

Affected products

• a2ui-project a2ui: 0.8, 0.9, 1.0

References

• https://github.com/a2ui-project/a2ui/
• https://github.com/a2ui-project/a2ui/commit/1b3bff234661ce922cbc3771be642b23ec9fd0fa
• https://github.com/a2ui-project/a2ui/issues/2299
• https://github.com/a2ui-project/a2ui/pull/2355
• https://vuldb.com/cve/CVE-2026-92357
• https://vuldb.com/submit/934118
• https://vuldb.com/vuln/405444
• https://vuldb.com/vuln/405444/cti

Get alerted when CVE-2026-92357 or the next vulnerability affects your stack