CVE-2026-10032: @a2ui/web_core XSS Vulnerability

CVE-2026-10032 Overview

CVE-2026-10032 is a cross-site scripting (XSS) vulnerability in the @a2ui/web_core package. The openUrl function passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When a user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin. The issue is classified under CWE-79 and affects default installations because the Basic Catalog is enabled by default.

Critical Impact
Arbitrary JavaScript executes in the victim application's browser origin when a user clicks an agent-supplied button, enabling session theft, account takeover, and data exfiltration.

Affected Products

@a2ui/web_core npm package
a2ui applications rendering the default Basic Catalog
Downstream applications embedding @a2ui/web_core Button components

Discovery Timeline

2026-08-04 - CVE-2026-10032 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-10032

Vulnerability Analysis

The vulnerability lives in the openUrl helper of @a2ui/web_core. This helper handles Button component functionCall actions and forwards the caller-supplied url value directly to window.open(). Because window.open() accepts any URI scheme the browser understands, an attacker-controlled value beginning with javascript: is treated as executable script rather than a navigation target.

The a2ui architecture treats agent responses as trusted rendering instructions. A malicious or compromised agent can therefore inject a Button whose action carries a javascript: payload. When the user clicks the button, the script runs in the origin of the host application. The attacker gains read and write access to session cookies, local storage, and any DOM-accessible authentication tokens.

The Basic Catalog ships enabled by default, so no non-standard configuration is required for exploitation. Any application that renders agent-authored UI through the default catalog is exposed.

Root Cause

The root cause is missing URI scheme validation in the openUrl function. The code trusts that agent-supplied URLs are http: or https: navigation targets and performs no allowlist or scheme check before invoking window.open(). This violates output-encoding requirements for CWE-79.

Attack Vector

An attacker who controls or influences agent output crafts a Button component. The Button's functionCall action specifies url: "javascript:<payload>". The a2ui client renders the button. When the victim clicks the button, window.open('javascript:<payload>') executes the payload in the application origin. The payload can exfiltrate tokens, submit authenticated requests, or pivot to further attacks against the user's session.

Exploitation requires user interaction (a click) but no elevated privileges beyond the ability to inject or influence an agent response. Refer to the GitHub Security Advisory GHSA-72qq-p3r5-f7wq for further technical detail.

Detection Methods for CVE-2026-10032

Indicators of Compromise

Agent response payloads containing Button components with url fields starting with javascript:, data:, or vbscript:
Browser console logs showing calls to window.open() with non-http(s) schemes originating from @a2ui/web_core
Unexpected outbound requests to attacker-controlled domains following user interaction with agent-rendered UI
Session tokens or authentication cookies appearing in DOM postMessage or fetch calls that were not initiated by application code

Detection Strategies

Inspect stored agent response logs for functionCall actions whose url argument does not match an ^https?:// pattern
Add runtime instrumentation around window.open() to log and alert on non-standard URI schemes
Deploy a strict Content Security Policy and monitor report-uri or report-to endpoints for script-src violations
Review web application firewall logs for anomalous JavaScript payloads embedded in agent-to-client traffic

Monitoring Recommendations

Enable CSP reporting in browsers rendering @a2ui/web_core components to capture inline script execution attempts
Track dependency inventories for pinned versions of @a2ui/web_core and flag versions predating the security advisory fix
Correlate user click telemetry with subsequent authenticated API calls to identify session abuse

How to Mitigate CVE-2026-10032

Immediate Actions Required

Upgrade @a2ui/web_core to the fixed version referenced in the GitHub Security Advisory GHSA-72qq-p3r5-f7wq
Audit agent-facing surfaces to constrain which components and actions agents may emit
Deploy a Content Security Policy that prohibits inline script execution and restricts script-src to trusted origins
Enumerate all applications embedding the package and schedule coordinated patching

Patch Information

Refer to the a2ui project security advisory GHSA-72qq-p3r5-f7wq for the fixed release and upgrade instructions. The fix adds URI scheme validation to the openUrl function so that only http: and https: URLs reach window.open().

Workarounds

Wrap or monkey-patch openUrl in host applications to reject any URL whose scheme is not http: or https:
Disable the Basic Catalog or remove the Button functionCall action from the allowed component set until the patch is applied
Enforce a strict CSP with script-src 'self' and no unsafe-inline to blunt javascript: URI execution
Sanitize agent responses server-side and drop any Button url value containing a non-allowlisted scheme

bash

# Configuration example: enforce URL scheme allowlist before rendering
# Pseudocode for a server-side sanitizer
if (!/^https?:\/\//i.test(button.action.url)) {
  reject_agent_response("invalid_url_scheme");
}