CVE-2026-118276 a2ui-project a2ui Parser expression_parser.ts formatString resource consumption

Medium 5.1 Published 28 Oct 2026 Updated 28 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-118276?

CVE-2026-118276 is a medium-severity vulnerability in a2ui-project a2ui, published on 28 Oct 2026.

Official description

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts of the component Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 1f71d1aac1b145ef57c7526f9e0cff316f5934e2. Applying a patch is the recommended action to fix this issue.

Weakness: CWE-404, CWE-400

Which versions are affected by CVE-2026-118276?

How do I fix CVE-2026-118276?

No fix has been published for CVE-2026-118276 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-118276 being exploited?

There is no known exploitation of CVE-2026-118276 in the wild and no public exploit code.

Sources

Also known as GHSA-5gqh-669g-4hvg.