CVE-2026-92357

Katalog CVE

CVSS 4.3 · Medium EPSS 0,39%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor. Skor CVSS 3.1 4.3 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument current[segment] leads to information disclosure. The attack may be initiated remotely. The identifier of the patch is 1b3bff234661ce922cbc3771be642b23ec9fd0fa. To fix this issue, it is recommended to deploy a patch.

Rincian

Terbit di NVD

16 September 2026

Terakhir diubah

28 September 2026

Status NVD

Deferred

CVSS 3.1

4.3 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-284: Improper Access Control

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/a2ui-project/a2ui/
• https://github.com/a2ui-project/a2ui/commit/1b3bff234661ce922cbc3771be642b23ec9fd0fa
• https://github.com/a2ui-project/a2ui/issues/2299
• https://github.com/a2ui-project/a2ui/pull/2355
• https://vuldb.com/cve/CVE-2026-92357
• https://vuldb.com/submit/934118
• https://vuldb.com/vuln/405444
• https://vuldb.com/vuln/405444/cti