Is CVE-2026-118275 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118275 being exploited in the wild.

How severe is CVE-2026-118275?

Medium severity, with a CVSS score of 5.3, published 28 October 2026.

Which products and versions are affected?

A2ui-Project A2ui up to 0.10.6.

Is there a fix for CVE-2026-118275?

Yes: fixed in a2ui 0.10.7 or later (commit c76e17272e52c12c6dcf68905b1df978c39e9aa5). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118275 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118275?

Check whether you run A2ui-Project A2ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118275: a2ui uncontrolled recursion in DynamicValue resolver

CVE-2026-118275 · Severity: medium · CVSS 5.3 · Published 2026-10-28

a2ui is a JavaScript UI framework that processes dynamic expressions to render web interfaces. An attacker can send a specially crafted expression with deeply nested function calls that causes the renderer to crash due to stack overflow, disrupting the application's availability. The vulnerability affects deployments using a2ui versions up to 0.10.6.

Technologies: A2ui-Project A2ui. Vendors: A2ui-Project.

Quick answers

Is CVE-2026-118275 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118275 being exploited in the wild.
How severe is CVE-2026-118275?: Medium severity, with a CVSS score of 5.3, published 28 October 2026.
Which products and versions are affected?: A2ui-Project A2ui up to 0.10.6.
Is there a fix for CVE-2026-118275?: Yes: fixed in a2ui 0.10.7 or later (commit c76e17272e52c12c6dcf68905b1df978c39e9aa5). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118275 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118275?: Check whether you run A2ui-Project A2ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: a2ui 0.10.7 or later (commit c76e17272e52c12c6dcf68905b1df978c39e9aa5)

Technical details

The DataContext.resolveSignal and DataContext.resolveDynamicValue functions recursively process nested function call objects without enforcing a maximum recursion depth, allowing an uncontrolled recursion attack (CWE-674, CWE-400). Payloads with 20,000+ nested function calls trigger a RangeError that crashes the renderer process or web worker. The fix adds a MAX_DYNAMIC_VALUE_DEPTH constant (20) and checks recursion depth before processing, returning an EXPRESSION_ERROR when exceeded.

Affected products

a2ui-project a2ui up to 0.10.6

Timeline

2026-10-28: disclosed
2026-09-21: patched: Fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.