CVE-2026-92213: a2ui Angular Renderer RCE Vulnerability

CVE-2026-92213 Overview

CVE-2026-92213 affects the a2ui-project a2ui library through version 0.10.6. The flaw resides in the z.any schema handler within renderers/web_core/src/v0_9/schema/server-to-client.ts, part of the Angular Renderer component. Attackers can manipulate the primaryColor argument to perform an injection attack against downstream rendering logic. The vulnerability is remotely exploitable and maps to CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component. Maintainers have released a fix, tracked in commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b, which introduces validation of the surface theme against the catalog themeSchema.

Critical Impact
Remote attackers with low privileges can inject unvalidated theme values through the primaryColor parameter, compromising confidentiality, integrity, and availability of the rendered Angular surface.

Affected Products

a2ui-project a2ui versions up to and including 0.10.6
renderers/web_core/src/v0_9/schema/server-to-client.ts (Angular Renderer)
Applications embedding @a2ui/web_core/v0_9/basic_catalog prior to patch fb8e85a

Discovery Timeline

2026-09-16 - CVE-2026-92213 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92213

Vulnerability Analysis

The a2ui Angular Renderer consumes server-defined UI descriptors, including theme values that flow into component styling. The affected schema uses z.any for the primaryColor field, which accepts arbitrary input without enforcing a CSS color type. Because the value is passed to CSS binding logic within the basic catalog components, an attacker who controls the server-to-client payload can inject unintended content into style contexts. The issue is classified under [CWE-74] as an injection weakness where downstream neutralization is missing. Exploitation requires a network path to the renderer and some level of user interaction to load the malicious surface.

Root Cause

The root cause is permissive schema validation. Using z.any bypasses type discrimination in Zod, so the primaryColor argument is not constrained to a valid CSS color literal before being applied to component styles. Any string reaching the theme injection point is treated as trusted.

Attack Vector

An attacker who can influence the server-to-client message payload delivers a crafted primaryColor value. When the Angular Renderer processes the payload, the malicious value is bound into style attributes on catalog components, producing the injection condition.

typescript

// Patch: renderers/angular/src/v0_9/catalog/basic/basic-catalog-component.ts
// fix(web_core): validate surface theme against catalog themeSchema (#2367)

import {Directive, computed, HostBinding, inject} from '@angular/core';
-import {injectBasicCatalogStyles} from '@a2ui/web_core/v0_9/basic_catalog';
+import {injectBasicCatalogStyles, isValidCssColor} from '@a2ui/web_core/v0_9/basic_catalog';
import {A2uiRendererService} from '../../core/a2ui-renderer.service';
import {ComponentApi} from '@a2ui/web_core/v0_9';
import {CatalogComponent} from '../../core/catalog_component';

Source: GitHub Commit fb8e85a

typescript

// Patch: renderers/angular/src/v0_9/catalog/basic/basic-catalog.ts
// Introduces BasicCatalogThemeSchema (Zod) to constrain theme values.

  ChoicePickerApi,
  SliderApi,
  DateTimeInputApi,
+  BasicCatalogThemeSchema,
+  type BasicCatalogTheme,
} from '@a2ui/web_core/v0_9/basic_catalog';
import {FunctionImplementation} from '@a2ui/web_core/v0_9';
+import {z} from 'zod';

Source: GitHub Commit fb8e85a

The patch replaces z.any acceptance with BasicCatalogThemeSchema and adds isValidCssColor checks, ensuring theme values are validated before use.

Detection Methods for CVE-2026-92213

Indicators of Compromise

Server-to-client A2UI payloads containing primaryColor values that are not valid CSS colors, such as strings with quotes, angle brackets, or CSS control characters.
Rendered DOM style attributes that carry unexpected tokens originating from primaryColor.
Runtime console warnings from Angular style bindings referencing the basic catalog theme.

Detection Strategies

Perform static review of any deployed a2ui version to confirm whether the schema still uses z.any for theme fields in server-to-client.ts.
Log and inspect inbound A2UI messages at the application boundary, alerting on primaryColor values that fail a strict CSS color regex.
Add integration tests that supply hostile primaryColor values to confirm the renderer rejects them post-patch.

Monitoring Recommendations

Monitor upstream A2UI services for anomalous theme fields in outbound messages.
Correlate web client error telemetry with style-binding failures on Angular catalog components.
Track dependency inventories for @a2ui/web_core versions at or below 0.10.6.

How to Mitigate CVE-2026-92213

Immediate Actions Required

Upgrade @a2ui/web_core and related a2ui packages to a release containing commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b.
Audit application code that consumes BasicCatalogTheme for additional fields still typed as any.
Restrict which upstream services are permitted to send A2UI surface definitions to trusted origins only.

Patch Information

The fix is delivered in commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b via pull request #2367. It introduces BasicCatalogThemeSchema and an isValidCssColor helper, replacing the permissive z.any handler. Additional context is available in issue #2293 and the VulDB entry for CVE-2026-92213.

Workarounds

Wrap the renderer input pipeline with a custom Zod validator that rejects primaryColor values not matching a strict CSS color format.
Sanitize or drop the primaryColor field at an API gateway before payloads reach the Angular Renderer.
Enforce a Content Security Policy that limits inline style sources to reduce the impact of injected theme values.

bash

# Update to a patched a2ui release once published
npm ls @a2ui/web_core
npm install @a2ui/web_core@latest

# Verify the patched commit is present
git -C node_modules/@a2ui/web_core log --oneline | grep fb8e85a