---
id: CVE-2026-118273
title: a2ui-project a2ui data-model.ts DataModel.set resource consumption
summary: >-
  A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this
  vulnerability is the function DataModel.set of the file
  renderers/web_core/src/v0_9/state/data-model.ts. Executing a manipulation can
  lead to resource consumption.…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-400
  - CWE-404
vendor: a2ui-project
product: a2ui
affected:
  - a2ui 0.10.0
  - a2ui 0.10.1
  - a2ui 0.10.2
  - a2ui 0.10.3
  - a2ui 0.10.4
  - a2ui 0.10.5
  - a2ui 0.10.6
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T20:06:02.581004Z'
exploitAvailable: true
published: '2026-10-28'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T20:06:25.459Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118273'
references:
  - url: 'https://vuldb.com/vuln/427571'
    label: >-
      VDB-427571 | a2ui-project a2ui data-model.ts DataModel.set resource
      consumption
  - url: 'https://vuldb.com/vuln/427571/cti'
    label: 'VDB-427571 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-118273'
    label: CVE-2026-118273 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1015117'
    label: 'Submit #1015117 | a2ui-project a2ui <=0.10.6 CWE-400'
  - url: 'https://github.com/a2ui-project/a2ui/issues/2386'
  - url: 'https://github.com/a2ui-project/a2ui/pull/2430'
  - url: >-
      https://github.com/a2ui-project/a2ui/commit/82789191ce551f4d7a095d273773fb24bd764c9d
  - url: 'https://github.com/a2ui-project/a2ui/'
tags:
  - cve.org
  - exploit-available
epss: 0.0031
epssPercentile: 0.23962
ingestedAt: '2026-10-28T03:02:57.608Z'
---

## Overview

A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/web_core/src/v0_9/state/data-model.ts. Executing a manipulation can lead to resource consumption. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called 82789191ce551f4d7a095d273773fb24bd764c9d. A patch should be applied to remediate this issue.

## Affected

- `a2ui 0.10.0`
- `a2ui 0.10.1`
- `a2ui 0.10.2`
- `a2ui 0.10.3`
- `a2ui 0.10.4`
- `a2ui 0.10.5`
- `a2ui 0.10.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.