2vulnerabilities
- Critical1 (50.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (50.0%)
- Low0 (0.0%)
a2ui-web_core
Ecosystem: npm
Downloads:
- 1CriticalAffects 1 version
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting a2ui-web_core, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-72qq-p3r5-f7wq | Critical | @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions### Summary The `openUrl` function in `@a2ui/web_core` passes an agent-controlled URL directly to `window.open()` without validating the URI scheme. A malicious agent can supply a `javascript:` URI as the `url` argument of a `Button` component's `functionCall` action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS. No non-default configuration is required; the Basic Catalog is enabled by default. ### Details The vulnerability exists in the `openUrl` function implementation within the Bas |
| GitHub (opens in a new tab) | |
| GHSA-w72q-x6w3-7rj3 | Moderate | Duplicate Advisory: @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72qq-p3r5-f7wq. This link is maintained to preserve external references. ## Original Description The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical sev |
| GitHub (opens in a new tab) |
- GHSA-72qq-p3r5-f7wqCritical@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
>= 0.9.0, < 0.10.2
### Summary The `openUrl` function in `@a2ui/web_core` passes an agent-controlled URL directly to `window.open()` without validating the URI scheme. A malicious agent can supply a `javascript:` URI as the `url` argument of a `Button` component's `functionCall` action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS. No non-default configuration is required; the Basic Catalog is enabled by default. ### Details The vulnerability exists in the `openUrl` function implementation within the Bas
CVE: CVE-2026-10032
- GHSA-w72q-x6w3-7rj3ModerateDuplicate Advisory: @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
>= 0.9.0
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72qq-p3r5-f7wq. This link is maintained to preserve external references. ## Original Description The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical sev