CVE-2026-118537
Last modified
CVE-2026-118537 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Video Player/Audio Player.
Description
A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| — | a2ui | 0.10.0; 0.10.1; 0.10.2; 0.10.3; 0.10.4 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-118537?
How severe is CVE-2026-118537?
How do I fix CVE-2026-118537?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-1185A configuration file on the local file system had improper i…8.8
- CVE-2026-11850An integer underflow vulnerability was found in MIT krb5 in …5
- CVE-2026-11851Improper Neutralization of Special Elements used in an SQL C…5.9
- CVE-2026-118510A type-handling flaw in the relationship query building of t…8.8
- CVE-2026-11852Debusine is an integrated solution to build, distribute and …6.5
- CVE-2026-11853Debusine is an integrated solution to build, distribute and …6.5
- CVE-2026-118538A vulnerability was determined in a2ui-project a2ui up to 0.…5.5
- CVE-2026-11854The authentication endpoint generates an error message that …6.1
- CVE-2026-11855The Simple Membership WordPress plugin before 4.7.5 does not…8.8
- CVE-2026-11856Successfully using libcurl to do a transfer to a specific HT…9.8
- CVE-2026-11857Quanos SCHEMA ST4 on-premises contains a local privilege esc…8.4
- CVE-2026-11858Quanos SCHEMA ST4 on-premises contains a local privilege esc…8.4
Are you affected by CVE-2026-118537?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST