Executive brief
a2ui is an open-source framework for building user interfaces used across multiple platforms. The Angular Renderer component failed to validate theme color values (specifically the primaryColor parameter), allowing attackers to inject malicious CSS that could alter page styling, inject content, or redirect users. A remote attacker could exploit this without authentication to compromise the visual integrity and functionality of applications built with a2ui.
Technical details
A validation bypass vulnerability exists in the a2ui Angular Renderer component where the createSurface.theme function accepts the primaryColor argument without proper sanitization or validation. The vulnerable code in renderers/web_core/src/v0_9/schema/server-to-client.ts directly uses the primaryColor value in CSS without checking that it is a valid hexadecimal color code, enabling CSS injection attacks. An unauthenticated remote attacker can send a crafted message with a malicious primaryColor value (e.g., containing CSS expressions or URLs) which gets applied directly to CSS variables or style attributes. The attack allows injection of arbitrary CSS rules that can deface the UI, leak information, or create phishing vectors. The patch (commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b) adds BasicCatalogThemeSchema validation to restrict primaryColor to valid hex color codes and changes CSS property declarations to prevent URL loading.
Affected products
- a2ui-project a2ui up to 0.10.6
Timeline
- 2026-09-16: disclosed
- 2026-09-14: patched: Patch fb8e85aec78d04e81feb9992a57638ca1ec4dc1b applied