Medium severity · published Sep 16, 2026
CVE-2026-92356
a2ui-project a2ui Update Components basic_functions.ts updateComponents resource consumption
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component Update Components. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A2
a2ui · a2ui-project
0.9; 0.9.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92356
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92356
github.com
https://github.com/a2ui-project/a2ui/
github.com
https://github.com/a2ui-project/a2ui/issues/2298
vuldb.com
https://vuldb.com/cve/CVE-2026-92356
vuldb.com
https://vuldb.com/submit/934117
vuldb.com
https://vuldb.com/vuln/405443
vuldb.com
https://vuldb.com/vuln/405443/cti
More from a2ui
7.3
CVE-2026-92215
a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery
6.3
CVE-2026-92217
a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes
5.5
CVE-2026-92213
a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection
5.3
CVE-2026-118275
a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption
5.3
CVE-2026-92114
a2ui-project a2ui Basic Catalog safe_regex.ts redos