Is CVE-2026-118537 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118537 being exploited in the wild.

How severe is CVE-2026-118537?

Medium severity, with a CVSS score of 4.3, published 28 October 2026.

Which products and versions are affected?

A2ui-Project A2ui up to 0.10.4; A2ui-Project Lit up to 0.10.4; A2ui-Project Web Core 0.11.0, 0.12.0.

Is there a fix for CVE-2026-118537?

No fixed version is recorded yet. Validate the URL scheme to allow only http: and https: before binding to the src attribute of media elements, mirroring the fix applied to the openUrl action in CVE-2026-10032. [{"kind":"disclosed","at":"2026-10-08","note":"Issue #3077 opened"},{"kind":"advisory","at":"2026-10-28","note":"CVE-2026-118537 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-118537 attacked?

It is attacked over the network.

Am I affected by CVE-2026-118537?

Check whether you run A2ui-Project A2ui, A2ui-Project Lit or A2ui-Project Web Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118537: a2ui improper input validation in media components URL

CVE-2026-118537 · Severity: medium · CVSS 4.3 · Published 2026-10-28

a2ui is a web UI component library used to render dynamic user interfaces. The Image, Video, and Audio Player components accept a URL parameter from an untrusted source and directly bind it to the media element's src attribute without validating the URL scheme. This allows an attacker to inject data:, javascript:, file:, or blob: URLs, causing the victim's browser to make credential-bearing requests to internal endpoints, enabling credential theft, internal network probing, and UI-based attacks.

Technologies: A2ui-Project A2ui. Vendors: A2ui-Project.

Quick answers

Is CVE-2026-118537 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118537 being exploited in the wild.
How severe is CVE-2026-118537?: Medium severity, with a CVSS score of 4.3, published 28 October 2026.
Which products and versions are affected?: A2ui-Project A2ui up to 0.10.4; A2ui-Project Lit up to 0.10.4; A2ui-Project Web Core 0.11.0, 0.12.0.
Is there a fix for CVE-2026-118537?: No fixed version is recorded yet. Validate the URL scheme to allow only http: and https: before binding to the src attribute of media elements, mirroring the fix applied to the openUrl action in CVE-2026-10032.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-08","note":"Issue #3077 opened"},{"kind":"advisory","at":"2026-10-28","note":"CVE-2026-118537 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-118537 attacked?: It is attacked over the network.
Am I affected by CVE-2026-118537?: Check whether you run A2ui-Project A2ui, A2ui-Project Lit or A2ui-Project Web Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Validate the URL scheme to allow only http: and https: before binding to the src attribute of media elements, mirroring the fix applied to the openUrl action in CVE-2026-10032.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-08","note":"Issue #3077 opened"},{"kind":"advisory","at":"2026-10-28","note":"CVE-2026-118537 published"}]

Technical details

The vulnerability is improper input validation (CWE-20) in the Image, Video, and AudioPlayer components across @a2ui/web_core and @a2ui/lit packages. The agent-supplied url property is rendered directly into the src attribute without scheme validation, allowing non-http(s) URLs including data:, javascript:, and file: schemes. An attacker can inject arbitrary URLs to trigger credential-bearing blind requests, internal endpoint probing, or content spoofing; a fix is available as PR #3108 which adds scheme validation.

Affected products

a2ui-project a2ui up to 0.10.4
a2ui-project web_core 0.11.0, 0.12.0
a2ui-project lit up to 0.10.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.