PT-2026-105490 · Npm · @A2Ui/Web Core

Published

2026-10-02

·

Updated

2026-10-02

CVSS v3.1

9.3

Critical

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Summary

The openUrl function in @a2ui/web core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS. No non-default configuration is required; the Basic Catalog is enabled by default.

Details

The vulnerability exists in the openUrl function implementation within the Basic Catalog of @a2ui/web core (commit 23a003248abbf59da6c376ea64ace91d82d209ff).
Sink — renderers/web core/src/v0 9/basic catalog/functions/basic functions.ts:428-430:
ts
export const OpenUrlImplementation = createFunctionImplementation(OpenUrlApi, args => {
 if (args.url && typeof window !== 'undefined' && window.open) {
  window.open(args.url, ' blank');
 }
});
window.open is called unconditionally with the agent-supplied args.url value. No scheme allowlist or blocklist is applied.
Insufficient schema validation — renderers/web core/src/v0 9/basic catalog/functions/basic functions api.ts:453-458:
ts
export const OpenUrlApi = {
 name: 'openUrl' as const,
 returnType: 'void' as const,
 schema: z.object({
  url: z.preprocess(v => (v === undefined ? undefined : String(v)), z.string()),
 }),
};
The Zod schema only requires a string; javascript: URIs pass validation without any rejection.
Full source-to-sink data flow:
  1. renderers/web core/src/v0 9/basic catalog/components/basic components.ts:356 — ButtonApi accepts action: ActionSchema (entry point).
  2. renderers/web core/src/v0 9/schema/common-types.ts:126-130 — ActionSchema permits { functionCall: FunctionCallSchema }.
  3. renderers/web core/src/v0 9/rendering/generic-binder.ts:243-255 — on click, bound action calls resolveDeepSync then dispatchAction.
  4. renderers/web core/src/v0 9/rendering/data-context.ts:93-105 — resolveDynamicValue detects the call key and invokes the named function.
  5. renderers/web core/src/v0 9/catalog/types.ts:177-186 — catalog invoker runs fn.schema.parse(rawArgs) then fn.execute().
  6. renderers/web core/src/v0 9/basic catalog/functions/basic functions api.ts:453-458 — OpenUrlApi validates url as z.string() only (no scheme check).
  7. renderers/web core/src/v0 9/basic catalog/functions/basic functions.ts:428-430 — sink: window.open(args.url, ' blank') executes the javascript: URI.
All three renderers implemented in the A2UI repository are affected:
  • React: renderers/react/src/v0 9/catalog/basic/components/Button.tsx:33 — onClick={props.action}
  • Lit: renderers/lit/src/v0 9/catalogs/basic/components/Button.ts:112 — @click=${() => props.action()}
  • Angular: renderers/angular/src/v0 9/catalog/basic/button.component.ts:103-110 — handleClick() → dataContext.resolveAction → dispatchAction
Any other A2UI renderer which depends on web core and uses its basic catalog implementation is also affected.

Remediation

The issue was fixed in https://github.com/a2ui-project/a2ui/pull/1707 and released in web core version 0.10.2, by blocking URLs that do not use the HTTP or HTTPS schemes, or those that are invalid.
Please fix this issue in your project by depending on a @a2ui/web core version equal or greater than 0.10.2.

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-72QQ-P3R5-F7WQ

Affected Products

@A2Ui/Web Core