CVE-2026-92357: a2ui-project a2ui Information Disclosure Flaw

CVE-2026-92357 Overview

CVE-2026-92357 is an information disclosure vulnerability in the a2ui-project a2ui library versions 0.8, 0.9, and 1.0. The flaw resides in the model-processor.ts file of the Model Processor component. Attackers can manipulate the current[segment] argument to traverse the JavaScript prototype chain and read properties not intended for exposure. The issue is remotely exploitable and requires low-privileged access. The maintainers assigned the vulnerability [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor] and released commit 1b3bff234661ce922cbc3771be642b23ec9fd0fa to address it.

Critical Impact
Remote attackers with low privileges can trigger information disclosure by exploiting unchecked property traversal in the a2ui v0_8 read path.

Affected Products

a2ui-project a2ui 0.8
a2ui-project a2ui 0.9
a2ui-project a2ui 1.0

Discovery Timeline

2026-09-16 - CVE-2026-92357 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92357

Vulnerability Analysis

The vulnerability lives in the property traversal logic of renderers/web_core/src/v0_8/data/model-processor.ts. When walking a user-supplied path across an object, the code accesses current[segment] without verifying the property is an own property of current. This allows a caller to request properties inherited from Object.prototype, such as constructor, __proto__, or toString. An attacker crafting a path segment that resolves to a prototype-chain property can read data or objects outside the intended data model. The result is information disclosure classified under [CWE-200].

Root Cause

The root cause is missing own-property validation on object segment access. The code branches on isObject(current) and then indexes with an attacker-influenced segment string. Without an Object.prototype.hasOwnProperty.call check, prototype-inherited properties are returned to the caller. This is a classic JavaScript prototype chain traversal pattern where developer intent ("read a field from this data model") diverges from JavaScript's default lookup semantics.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An attacker submits a data path containing a segment name that matches an inherited property. The Model Processor resolves the segment against the current object and returns the prototype-chain value to the requester. No memory corruption occurs; the impact is limited to confidentiality of exposed properties.

typescript

// Patched code from model-processor.ts
// Source: https://github.com/a2ui-project/a2ui/commit/1b3bff234661ce922cbc3771be642b23ec9fd0fa
      } else if (Array.isArray(current) && /^\d+$/.test(segment)) {
        current = current[parseInt(segment, 10)];
      } else if (isObject(current)) {
+       if (!Object.prototype.hasOwnProperty.call(current, segment)) {
+         return null;
+       }
        current = current[segment];
      } else {
        // If we need to traverse deeper but `current` is a primitive, the path is invalid.

The patch adds an Object.prototype.hasOwnProperty.call(current, segment) guard that returns null when the segment is not an own property, blocking prototype chain traversal.

Detection Methods for CVE-2026-92357

Indicators of Compromise

Application logs showing path traversal requests containing segments such as __proto__, constructor, prototype, or toString submitted to a2ui data-model endpoints.
Unexpected null or serialized function responses returned from model-processor.ts read paths after applying the patch.
Traffic from unauthenticated or low-privileged sessions probing multiple object-path variations against a2ui-backed views.

Detection Strategies

Inspect a2ui HTTP request payloads and parameters for reserved JavaScript property names in path segments.
Enable verbose logging on the Model Processor to capture the resolved path and the type of returned value for auditing.
Compare installed a2ui versions against 0.8, 0.9, and 1.0 across build manifests, package.json, and lockfiles.

Monitoring Recommendations

Alert on repeated 4xx/2xx responses correlated with prototype-related segment names in application access logs.
Track outbound responses containing serialized function bodies or object metadata from a2ui-served endpoints.
Monitor the a2ui GitHub Issue Tracker and Pull Request 2355 for supplementary fixes or backports.

How to Mitigate CVE-2026-92357

Immediate Actions Required

Upgrade a2ui to a version containing commit 1b3bff234661ce922cbc3771be642b23ec9fd0fa from the a2ui GitHub repository.
Inventory all applications embedding a2ui versions 0.8, 0.9, or 1.0 and prioritize patching internet-facing deployments.
Restrict access to a2ui data-model endpoints to authenticated users while patching is in progress.

Patch Information

The maintainers merged the fix in Pull Request 2355 and released it as commit 1b3bff234661ce922cbc3771be642b23ec9fd0fa. The patch adds an own-property check via Object.prototype.hasOwnProperty.call(current, segment) in the v0_8 read path of model-processor.ts. Full details are available in the GitHub Commit and the VulDB CVE Report.

Workarounds

Apply a request filter that rejects path segments matching JavaScript reserved property names, including __proto__, constructor, and prototype.
Wrap incoming data models with Object.create(null) where feasible to eliminate the inherited prototype chain.
Downgrade to a known-good release only if a patched version is unavailable and compensating controls are in place.

bash

# Update a2ui to a patched build via npm
npm install a2ui@latest
npm ls a2ui
git -C node_modules/a2ui log --oneline | grep 1b3bff23