Vulnerability · Published Sep 16, 2026 · Assigned by VulDB
CVE-2026-92214a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting
Low 3.5
In plain English
A low-severity cross-site scripting in a2ui from a2ui-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.3%top 71.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| a2ui-project | a2ui | 0.10.00.10.10.10.20.10.30.10.40.10.50.10.60.10.7 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R
References
- VDB-404459 | a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting vdb-entry
- VDB-404459 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-92214 | CVE Analysis and Report third-party-advisory
- Submit #934108 | a2ui-project a2ui v0.0.1 CWE-79 third-party-advisory
- https://github.com/a2ui-project/a2ui/issues/2294 issue-tracking
- https://github.com/a2ui-project/a2ui/ product