CVE-2026-10032

Summary

The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS. No non-default configuration is required; the Basic Catalog is enabled by default.

Details

The vulnerability exists in the openUrl function implementation within the Basic Catalog of @a2ui/web_core (commit 23a003248abbf59da6c376ea64ace91d82d209ff).

Sink — renderers/webcore/src/v09/basiccatalog/functions/basicfunctions.ts:428-430:

export const OpenUrlImplementation = createFunctionImplementation(OpenUrlApi, args => {
  if (args.url && typeof window !== 'undefined' && window.open) {
    window.open(args.url, '_blank');
  }
});

window.open is called unconditionally with the agent-supplied args.url value. No scheme allowlist or blocklist is applied.

Insufficient schema validation — renderers/webcore/src/v09/basiccatalog/functions/basicfunctions_api.ts:453-458:

export const OpenUrlApi = {
  name: 'openUrl' as const,
  returnType: 'void' as const,
  schema: z.object({
    url: z.preprocess(v => (v === undefined ? undefined : String(v)), z.string()),
  }),
};

The Zod schema only requires a string; javascript: URIs pass validation without any rejection.

Full source-to-sink data flow:

1. renderers/webcore/src/v09/basiccatalog/components/basiccomponents.ts:356 — ButtonApi accepts action: ActionSchema (entry point).  
2. renderers/webcore/src/v09/schema/common-types.ts:126-130 — ActionSchema permits { functionCall: FunctionCallSchema }.  
3. renderers/webcore/src/v09/rendering/generic-binder.ts:243-255 — on click, bound action calls resolveDeepSync then dispatchAction.  
4. renderers/webcore/src/v09/rendering/data-context.ts:93-105 — resolveDynamicValue detects the call key and invokes the named function.  
5. renderers/webcore/src/v09/catalog/types.ts:177-186 — catalog invoker runs fn.schema.parse(rawArgs) then fn.execute().  
6. renderers/webcore/src/v09/basiccatalog/functions/basicfunctions_api.ts:453-458 — OpenUrlApi validates url as z.string() only (no scheme check).  
7. renderers/webcore/src/v09/basiccatalog/functions/basicfunctions.ts:428-430 — sink: window.open(args.url, '_blank') executes the javascript: URI.

All three renderers implemented in the A2UI repository are affected:

• React: renderers/react/src/v0_9/catalog/basic/components/Button.tsx:33 — onClick={props.action}  
• Lit: renderers/lit/src/v0_9/catalogs/basic/components/Button.ts:112 — @click=${() => props.action()}  
• Angular: renderers/angular/src/v0_9/catalog/basic/button.component.ts:103-110 — handleClick() → dataContext.resolveAction → dispatchAction

Any other A2UI renderer which depends on web_core and uses its basic catalog implementation is also affected.

Remediation

The issue was fixed in https://github.com/a2ui-project/a2ui/pull/1707 and released in web_core version 0.10.2, by blocking URLs that do not use the HTTP or HTTPS schemes, or those that are invalid.

Please fix this issue in your project by depending on a @a2ui/web_core version equal or greater than 0.10.2.