Executive brief
a2ui is a community sample project for building chat interfaces with Angular. A flaw in the default text renderer for the a2a-chat-canvas component fails to properly sanitize HTML content from chat messages, allowing remote attackers to inject malicious scripts that execute in users' browsers. This can lead to account takeover, credential theft, or defacement.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the sanitizer-markdown-renderer-service.ts component. The vulnerable code calls Angular's bypassSecurityTrustHtml() on unsanitized agent-supplied text and then binds it to the DOM via @HostBinding('innerHTML'), completely bypassing Angular's built-in HTML sanitization. An attacker can craft a chat message containing malicious HTML/JavaScript (e.g., img src with onerror event handler) that executes in the context of the host application. The vulnerability affects the community sample code up to version 0.10.7 and is the default configuration, meaning applications copying the sample inherit the unsafe behavior. Patches or workarounds involve replacing the unsafe renderer with a sanitizing pipeline such as markdown-it with html:false and DOMPurify.
Affected products
- a2ui-project a2ui up to 0.10.7
Timeline
- 2026-08-17: disclosed: Vulnerability disclosed as GitHub issue #2294
- 2026-09-16: advisory: CVE-2026-92214 published