CVE-2026-92213

Name of the Vulnerable Software and Affected Versions a2ui-project a2ui versions prior to 0.10.7

Description An injection flaw exists in the Angular Renderer component within the file renderers/web core/src/v0 9/schema/server-to-client.ts. The issue occurs in the z.any() function when the primaryColor argument is manipulated, allowing a remote attacker to perform an injection attack.

Recommendations Install patch fb8e85aec78d04e81feb9992a57638ca1ec4dc1b. As a temporary workaround, restrict the use of the primaryColor argument in the z.any() function.