Cross-Site Scripting Vulnerability in a2ui/web_core Product
CVE-2026-10032

6.1MEDIUM

Key Information:

Vendor

Google
Status
@a2ui/web Core
Vendor
CVE Published:
4 August 2026

What is CVE-2026-10032?

The openUrl function in the a2ui/web_core library allows user-controlled URLs to be passed directly to window.open() without appropriate validation of the URI scheme. This oversight can enable an attacker to inject a javascript: URI through the url argument in a Button component's functionality. When an unsuspecting user interacts with this button, it leads to the execution of arbitrary JavaScript in the user's browser context, which poses significant security risks. This vulnerability is particularly concerning as it does not require any special configuration changes to be exploitable, given that the Basic Catalog is enabled by default.

Affected Version(s)

@a2ui/web_core 0.9.0

@a2ui/web_core 0.9.1-alpha.0

@a2ui/web_core 0.9.1-alpha.1

References

https://github.com/a2ui-project/a2ui/security/advisories/...

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.