CVE-2026-10032: @a2ui/web_core Critical XSS Vulnerability via openUrl Function
Summary
CVE-2026-10032: @a2ui/web_core: openUrl permits javascript: URI execution via agent-supplied button actions. Affects @a2ui/web_core versions >= 0.9.0, < 0.10.2. Fixed in 0.10.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @a2ui/web_core package is a core library used in various web applications to facilitate UI components and interactions. It provides a set of functionalities, including the ability to open URLs through user actions. However, a critical vulnerability has been identified in its openUrl function, which allows for the execution of arbitrary JavaScript code through maliciously crafted URLs.
Vulnerability Detail
The vulnerability arises from the openUrl function in @a2ui/web_core, which directly passes user-supplied URLs to the window.open() method without validating the URI scheme. This oversight allows an attacker to inject a javascript: URI, leading to stored or reflected cross-site scripting (XSS) attacks. When a user clicks a button that triggers this function, arbitrary JavaScript can execute in the context of the victim's browser, potentially compromising sensitive information and application integrity.
How To Fix
Latest published version: 0.14.0 as of 23 Oct 2026
npm install @a2ui/web_core@0.14.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10.2
This is the first release that contains the fix.
npm install @a2ui/web_core@0.10.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the openUrl function with user-supplied URLs until the package is updated. Ensure that any buttons or actions that utilize this function are disabled or modified to prevent potential exploitation.
Conclusion
The @a2ui/web_core package has a critical vulnerability that allows for XSS attacks through the openUrl function. It is crucial for developers to update to version 0.10.2 or later to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for @a2ui/web_core →
FAQ
The vulnerability allows for the execution of arbitrary JavaScript code via the openUrl function, leading to potential XSS attacks.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors for open-source vulnerabilities without requiring installation.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, session hijacking, and other malicious activities within the user's browser.
Yes, the vulnerability has been patched in version 0.10.2 of @a2ui/web_core. It is recommended to update to this version or later.
The CVSS score of this vulnerability is 9.3, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for @a2ui/web_core.
