Is CVE-2026-92213 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92213 being exploited in the wild.

How severe is CVE-2026-92213?

Medium severity, with a CVSS score of 5.5, published 16 September 2026.

Which products and versions are affected?

a2ui-project a2ui up to 0.10.6.

Is there a fix for CVE-2026-92213?

A patch was published on 2026-09-14: Patch fb8e85aec78d04e81feb9992a57638ca1ec4dc1b applied Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92213 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92213?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92213: a2ui Angular Renderer CSS injection via primaryColor

CVE-2026-92213 · Severity: medium · CVSS 5.5 · Published 2026-09-16

a2ui is an open-source framework for building user interfaces used across multiple platforms. The Angular Renderer component failed to validate theme color values (specifically the primaryColor parameter), allowing attackers to inject malicious CSS that could alter page styling, inject content, or redirect users. A remote attacker could exploit this without authentication to compromise the visual integrity and functionality of applications built with a2ui.

Quick answers

Is CVE-2026-92213 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92213 being exploited in the wild.
How severe is CVE-2026-92213?: Medium severity, with a CVSS score of 5.5, published 16 September 2026.
Which products and versions are affected?: a2ui-project a2ui up to 0.10.6.
Is there a fix for CVE-2026-92213?: A patch was published on 2026-09-14: Patch fb8e85aec78d04e81feb9992a57638ca1ec4dc1b applied Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92213 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92213?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A validation bypass vulnerability exists in the a2ui Angular Renderer component where the createSurface.theme function accepts the primaryColor argument without proper sanitization or validation. The vulnerable code in renderers/web_core/src/v0_9/schema/server-to-client.ts directly uses the primaryColor value in CSS without checking that it is a valid hexadecimal color code, enabling CSS injection attacks. An unauthenticated remote attacker can send a crafted message with a malicious primaryColor value (e.g., containing CSS expressions or URLs) which gets applied directly to CSS variables or style attributes. The attack allows injection of arbitrary CSS rules that can deface the UI, leak information, or create phishing vectors. The patch (commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b) adds BasicCatalogThemeSchema validation to restrict primaryColor to valid hex color codes and changes CSS property declarations to prevent URL loading.

Affected products

a2ui-project a2ui up to 0.10.6

Timeline

2026-09-16: disclosed
2026-09-14: patched: Patch fb8e85aec78d04e81feb9992a57638ca1ec4dc1b applied

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.