---
id: CVE-2026-118275
title: >-
  a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource
  consumption
summary: >-
  A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the
  function DataContext.resolveSignal of the file
  renderers/web_core/src/v0_9/rendering/data-context.ts of the component
  Resolver. The manipulation results in res…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-400
  - CWE-404
vendor: a2ui-project
product: a2ui
affected:
  - a2ui 0.10.0
  - a2ui 0.10.1
  - a2ui 0.10.2
  - a2ui 0.10.3
  - a2ui 0.10.4
  - a2ui 0.10.5
  - a2ui 0.10.6
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-28T15:59:08.017781Z'
exploitAvailable: true
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:10:54.352Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118275'
references:
  - url: 'https://vuldb.com/vuln/427573'
    label: >-
      VDB-427573 | a2ui-project a2ui Resolver data-context.ts
      DataContext.resolveSignal resource consumption
  - url: 'https://vuldb.com/vuln/427573/cti'
    label: 'VDB-427573 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-118275'
    label: CVE-2026-118275 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1015137'
    label: 'Submit #1015137 | a2ui-project a2ui <=0.10.6 CWE-400'
  - url: 'https://github.com/a2ui-project/a2ui/issues/2388'
  - url: 'https://github.com/a2ui-project/a2ui/pull/2432'
  - url: >-
      https://github.com/a2ui-project/a2ui/commit/c76e17272e52c12c6dcf68905b1df978c39e9aa5
  - url: 'https://github.com/a2ui-project/a2ui/'
tags:
  - cve.org
  - exploit-available
epss: 0.00428
epssPercentile: 0.37218
ingestedAt: '2026-10-28T04:03:46.654Z'
---

## Overview

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as c76e17272e52c12c6dcf68905b1df978c39e9aa5. It is advisable to implement a patch to correct this issue.

## Affected

- `a2ui 0.10.0`
- `a2ui 0.10.1`
- `a2ui 0.10.2`
- `a2ui 0.10.3`
- `a2ui 0.10.4`
- `a2ui 0.10.5`
- `a2ui 0.10.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.