---
id: CVE-2026-118276
title: >-
  a2ui-project a2ui Parser expression_parser.ts formatString resource
  consumption
summary: >-
  A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This
  vulnerability affects the function formatString of the file
  renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts of
  the component Parser. This m…
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-400
  - CWE-404
vendor: a2ui-project
product: a2ui
affected:
  - a2ui 0.10.0
  - a2ui 0.10.1
  - a2ui 0.10.2
  - a2ui 0.10.3
  - a2ui 0.10.4
  - a2ui 0.10.5
  - a2ui 0.10.6
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T03:45:18.266Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118276'
references:
  - url: 'https://vuldb.com/vuln/427574'
    label: >-
      VDB-427574 | a2ui-project a2ui Parser expression_parser.ts formatString
      resource consumption
  - url: 'https://vuldb.com/vuln/427574/cti'
    label: 'VDB-427574 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-118276'
    label: CVE-2026-118276 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1015139'
    label: 'Submit #1015139 | a2ui-project a2ui <=0.10.6 CWE-400'
  - url: 'https://github.com/a2ui-project/a2ui/issues/2389'
  - url: 'https://github.com/a2ui-project/a2ui/pull/2433'
  - url: >-
      https://github.com/a2ui-project/a2ui/commit/1f71d1aac1b145ef57c7526f9e0cff316f5934e2
  - url: 'https://github.com/a2ui-project/a2ui/'
tags:
  - cve.org
ingestedAt: '2026-10-28T04:03:46.639Z'
---

## Overview

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts of the component Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 1f71d1aac1b145ef57c7526f9e0cff316f5934e2. Applying a patch is the recommended action to fix this issue.

## Affected

- `a2ui 0.10.0`
- `a2ui 0.10.1`
- `a2ui 0.10.2`
- `a2ui 0.10.3`
- `a2ui 0.10.4`
- `a2ui 0.10.5`
- `a2ui 0.10.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.