Vulnerability-Lookup

GHSA-72QQ-P3R5-F7WQ

Vulnerability from github – Published: 2026-10-02 22:55 – Updated: 2026-10-02 22:55

Summary

@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Details

Summary

The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS. No non-default configuration is required; the Basic Catalog is enabled by default.

Details

The vulnerability exists in the openUrl function implementation within the Basic Catalog of @a2ui/web_core (commit 23a003248abbf59da6c376ea64ace91d82d209ff).

Sink — renderers/web_core/src/v0_9/basic_catalog/functions/basic_functions.ts:428-430:

export const OpenUrlImplementation = createFunctionImplementation(OpenUrlApi, args => {
  if (args.url && typeof window !== 'undefined' && window.open) {
    window.open(args.url, '_blank');
  }
});

window.open is called unconditionally with the agent-supplied args.url value. No scheme allowlist or blocklist is applied.

Insufficient schema validation — renderers/web_core/src/v0_9/basic_catalog/functions/basic_functions_api.ts:453-458:

export const OpenUrlApi = {
  name: 'openUrl' as const,
  returnType: 'void' as const,
  schema: z.object({
    url: z.preprocess(v => (v === undefined ? undefined : String(v)), z.string()),
  }),
};

The Zod schema only requires a string; javascript: URIs pass validation without any rejection.

Full source-to-sink data flow:

renderers/web_core/src/v0_9/basic_catalog/components/basic_components.ts:356 — ButtonApi accepts action: ActionSchema (entry point).
renderers/web_core/src/v0_9/schema/common-types.ts:126-130 — ActionSchema permits { functionCall: FunctionCallSchema }.
renderers/web_core/src/v0_9/rendering/generic-binder.ts:243-255 — on click, bound action calls resolveDeepSync then dispatchAction.
renderers/web_core/src/v0_9/rendering/data-context.ts:93-105 — resolveDynamicValue detects the call key and invokes the named function.
renderers/web_core/src/v0_9/catalog/types.ts:177-186 — catalog invoker runs fn.schema.parse(rawArgs) then fn.execute().
renderers/web_core/src/v0_9/basic_catalog/functions/basic_functions_api.ts:453-458 — OpenUrlApi validates url as z.string() only (no scheme check).
renderers/web_core/src/v0_9/basic_catalog/functions/basic_functions.ts:428-430 — sink: window.open(args.url, '_blank') executes the javascript: URI.

All three renderers implemented in the A2UI repository are affected:

React: renderers/react/src/v0_9/catalog/basic/components/Button.tsx:33 — onClick={props.action}
Lit: renderers/lit/src/v0_9/catalogs/basic/components/Button.ts:112 — @click=${() => props.action()}
Angular: renderers/angular/src/v0_9/catalog/basic/button.component.ts:103-110 — handleClick() → dataContext.resolveAction → dispatchAction

Any other A2UI renderer which depends on web_core and uses its basic catalog implementation is also affected.

Remediation

The issue was fixed in https://github.com/a2ui-project/a2ui/pull/1707 and released in web_core version 0.10.2, by blocking URLs that do not use the HTTP or HTTPS schemes, or those that are invalid.

Please fix this issue in your project by depending on a @a2ui/web_core version equal or greater than 0.10.2.

Severity

9.3 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@a2ui/web_core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.9.0"
            },
            {
              "fixed": "0.10.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-10032"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-02T22:55:49Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nThe `openUrl` function in `@a2ui/web_core` passes an agent-controlled URL directly to `window.open()` without validating the URI scheme. A malicious agent can supply a `javascript:` URI as the `url` argument of a `Button` component\u0027s `functionCall` action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application\u0027s browser origin, constituting a stored/reflected XSS. No non-default configuration is required; the Basic Catalog is enabled by default.\n\n### Details\n\nThe vulnerability exists in the `openUrl` function implementation within the Basic Catalog of `@a2ui/web_core` (commit `23a003248abbf59da6c376ea64ace91d82d209ff`).\n\n**Sink** \u2014 `renderers/web_core/src/v0_9/basic_catalog/functions/basic_functions.ts:428-430`:\n\n```ts\nexport const OpenUrlImplementation = createFunctionImplementation(OpenUrlApi, args =\u003e {\n  if (args.url \u0026\u0026 typeof window !== \u0027undefined\u0027 \u0026\u0026 window.open) {\n    window.open(args.url, \u0027_blank\u0027);\n  }\n});\n```\n\n`window.open` is called unconditionally with the agent-supplied `args.url` value. No scheme allowlist or blocklist is applied.\n\n**Insufficient schema validation** \u2014 `renderers/web_core/src/v0_9/basic_catalog/functions/basic_functions_api.ts:453-458`:\n\n```ts\nexport const OpenUrlApi = {\n  name: \u0027openUrl\u0027 as const,\n  returnType: \u0027void\u0027 as const,\n  schema: z.object({\n    url: z.preprocess(v =\u003e (v === undefined ? undefined : String(v)), z.string()),\n  }),\n};\n```\n\nThe Zod schema only requires a `string`; `javascript:` URIs pass validation without any rejection.\n\n**Full source-to-sink data flow:**\n\n1. `renderers/web_core/src/v0_9/basic_catalog/components/basic_components.ts:356` \u2014 `ButtonApi` accepts `action: ActionSchema` (entry point).  \n2. `renderers/web_core/src/v0_9/schema/common-types.ts:126-130` \u2014 `ActionSchema` permits `{ functionCall: FunctionCallSchema }`.  \n3. `renderers/web_core/src/v0_9/rendering/generic-binder.ts:243-255` \u2014 on click, bound action calls `resolveDeepSync` then `dispatchAction`.  \n4. `renderers/web_core/src/v0_9/rendering/data-context.ts:93-105` \u2014 `resolveDynamicValue` detects the `call` key and invokes the named function.  \n5. `renderers/web_core/src/v0_9/catalog/types.ts:177-186` \u2014 catalog invoker runs `fn.schema.parse(rawArgs)` then `fn.execute()`.  \n6. `renderers/web_core/src/v0_9/basic_catalog/functions/basic_functions_api.ts:453-458` \u2014 `OpenUrlApi` validates `url` as `z.string()` only (no scheme check).  \n7. `renderers/web_core/src/v0_9/basic_catalog/functions/basic_functions.ts:428-430` \u2014 **sink**: `window.open(args.url, \u0027_blank\u0027)` executes the `javascript:` URI.\n\n**All three renderers implemented in the A2UI repository are affected:**\n\n- React: `renderers/react/src/v0_9/catalog/basic/components/Button.tsx:33` \u2014 `onClick={props.action}`  \n- Lit: `renderers/lit/src/v0_9/catalogs/basic/components/Button.ts:112` \u2014 `@click=${() =\u003e props.action()}`  \n- Angular: `renderers/angular/src/v0_9/catalog/basic/button.component.ts:103-110` \u2014 `handleClick()` \u2192 `dataContext.resolveAction` \u2192 `dispatchAction`\n\nAny other A2UI renderer which depends on `web_core` and uses its basic catalog implementation is also affected.\n\n### Remediation\n\nThe issue was fixed in [https://github.com/a2ui-project/a2ui/pull/1707](https://github.com/a2ui-project/a2ui/pull/1707) and released in web\\_core version 0.10.2, by blocking URLs that do not use the HTTP or HTTPS schemes, or those that are invalid.\n\nPlease fix this issue in your project by depending on a @a2ui/web\\_core version equal or greater than 0.10.2.",
  "id": "GHSA-72qq-p3r5-f7wq",
  "modified": "2026-10-02T22:55:49Z",
  "published": "2026-10-02T22:55:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/a2ui-project/a2ui/security/advisories/GHSA-72qq-p3r5-f7wq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10032"
    },
    {
      "type": "WEB",
      "url": "https://github.com/a2ui-project/a2ui/pull/1707"
    },
    {
      "type": "WEB",
      "url": "https://github.com/a2ui-project/a2ui/commit/71573078c4168b2dc166bb847c3a85715dadc675"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/a2ui-project/a2ui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions"
}

CVE-2026-10032 (GCVE-0-2026-10032)

Vulnerability from cvelistv5 – Published: 2026-08-04 15:36 – Updated: 2026-08-04 17:43

Title

Arbitrary JavaScript Execution via openUrl in @a2ui/web_core

Summary

The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default.

Severity

6.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-04 17:42 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Google Google root Scorecard

References

1 reference

URL	Tags
https://github.com/a2ui-project/a2ui/security/adv…

Impacted products

1 product

Vendor	Product	Version
Google	@a2ui/web_core	Affected: 0.9.0 Affected: 0.9.1-alpha.0 Affected: 0.9.1-alpha.1 Affected: 0.9.1-alpha.2 Affected: 0.9.1-alpha.3 Affected: 0.9.1-alpha.4 Affected: 0.9.1-alpha.5 Affected: 0.9.1 Affected: 0.9.2 Affected: 0.10.0 Affected: 0.10.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-10032",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T17:42:13.437105Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T17:43:20.898Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "@a2ui/web_core",
          "vendor": "Google",
          "versions": [
            {
              "status": "affected",
              "version": "0.9.0"
            },
            {
              "status": "affected",
              "version": "0.9.1-alpha.0"
            },
            {
              "status": "affected",
              "version": "0.9.1-alpha.1"
            },
            {
              "status": "affected",
              "version": "0.9.1-alpha.2"
            },
            {
              "status": "affected",
              "version": "0.9.1-alpha.3"
            },
            {
              "status": "affected",
              "version": "0.9.1-alpha.4"
            },
            {
              "status": "affected",
              "version": "0.9.1-alpha.5"
            },
            {
              "status": "affected",
              "version": "0.9.1"
            },
            {
              "status": "affected",
              "version": "0.9.2"
            },
            {
              "status": "affected",
              "version": "0.10.0"
            },
            {
              "status": "affected",
              "version": "0.10.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component\u0027s functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application\u0027s browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default."
            }
          ],
          "value": "The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component\u0027s functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application\u0027s browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-244",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-244 Embedded Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "UNREPORTED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T15:36:45.199Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://github.com/a2ui-project/a2ui/security/advisories/GHSA-72qq-p3r5-f7wq"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary JavaScript Execution via openUrl in @a2ui/web_core",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2026-10032",
    "datePublished": "2026-08-04T15:36:45.199Z",
    "dateReserved": "2026-05-28T18:45:17.761Z",
    "dateUpdated": "2026-08-04T17:43:20.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-72QQ-P3R5-F7WQ

Summary

Details

Remediation

CVE-2026-10032 (GCVE-0-2026-10032)

Tags

Sightings

Nomenclature

Related by attack behaviour