CVE-2026-92214

Name of the Vulnerable Software and Affected Versions a2ui-project a2ui versions prior to 0.10.8

Description A flaw in the a2a-chat-canvas component allows a remote attacker to perform cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. The issue resides within an unknown function in the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts.

Recommendations Update to a version newer than 0.10.7. Restrict the use of the a2a-chat-canvas component until the update is applied.