CVE-2026-10032

Name of the Vulnerable Software and Affected Versions @a2ui/web core (affected versions not specified)

Description The openUrl() function fails to validate the URI scheme before passing a URL to window.open(). A malicious agent can provide a javascript: URI via the url argument of a Button component's functionCall action. This allows arbitrary JavaScript to execute within the browser origin of the victim application when the button is clicked, resulting in stored or reflected Cross-Site Scripting (XSS), which is a vulnerability where malicious scripts are injected into otherwise trusted websites. This issue occurs with default configurations as the Basic Catalog is enabled by default.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the url argument within the functionCall action of Button components to prevent the injection of javascript: URIs.