Vulnerability · Published Oct 28, 2026 · Assigned by VulDB

CVE-2026-118537a2ui Image Player/Video Player/Audio Player Image.js input validation

Medium 4.3

In plain English

A medium-severity improper input validation in a2ui. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 68.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

Affected products (as reported)

Vendor	Product	Versions
n/a	a2ui	0.10.00.10.10.10.20.10.30.10.4

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C

References

VDB-428014 | a2ui Image Player/Video Player/Audio Player Image.js input validation vdb-entry, technical-description
VDB-428014 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-118537 | CVE Analysis and Report third-party-advisory
Submit #1020092 | a2ui-project a2ui <=0.10.4 CWE-20 third-party-advisory
https://github.com/a2ui-project/a2ui/issues/3077 issue-tracking
https://github.com/a2ui-project/a2ui/pull/3108 issue-tracking, patch