Is CVE-2026-118273 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118273 being exploited in the wild.

How severe is CVE-2026-118273?

Medium severity, with a CVSS score of 4.3, published 28 October 2026.

Which products and versions are affected?

A2ui-Project A2ui up to 0.10.6.

How is CVE-2026-118273 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118273?

Check whether you run A2ui-Project A2ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118273: a2ui DataModel.set resource consumption via unbounded array indices

CVE-2026-118273 · Severity: medium · CVSS 4.3 · Published 2026-10-28

a2ui is a JavaScript UI framework component used in web applications. A flaw in the DataModel.set function allows an attacker to create unbounded array indices, causing the application to consume excessive memory and processing power, potentially freezing or crashing the web application. The vulnerability can be exploited remotely without authentication.

Technologies: A2ui-Project A2ui. Vendors: A2ui-Project.

Quick answers

Is CVE-2026-118273 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118273 being exploited in the wild.
How severe is CVE-2026-118273?: Medium severity, with a CVSS score of 4.3, published 28 October 2026.
Which products and versions are affected?: A2ui-Project A2ui up to 0.10.6.
Is there a fix for CVE-2026-118273?: Yes: fixed in a2ui 0.10.7 (commit 82789191ce551f4d7a095d273773fb24bd764c9d). Until then: Restrict user input to DataModel.set operations to prevent setting array indices above a safe threshold (10000 or lower depending on application constraints). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118273 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118273?: Check whether you run A2ui-Project A2ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: a2ui 0.10.7 (commit 82789191ce551f4d7a095d273773fb24bd764c9d)

Restrict user input to DataModel.set operations to prevent setting array indices above a safe threshold (10000 or lower depending on application constraints).

Technical details

The vulnerability exists in DataModel.set (file renderers/web_core/src/v0_9/state/data-model.ts) where setting data at large array indices (e.g., DataModel.set('/items/10000000', value)) allows the array to expand without bounds. When notifying ancestor signals via updateSignal, the spread operator [...val] iterates over millions of empty sparse slots, causing main-thread freezing and Out-Of-Memory (OOM) crashes (CWE-400, CWE-770). A remote attacker can trigger this via network without prior authentication.

Affected products

a2ui-project a2ui up to 0.10.6

Timeline

2026-10-28: disclosed: CVE-2026-118273 published
2026-09-14: patched: Fix commit 82789191ce551f4d7a095d273773fb24bd764c9d merged

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.