A2UI web_core: openUrl permits javascript: URI execution

The openUrl function in @a2ui/web_core passes agent-controlled URLs directly to window.open() without validating the URI scheme, allowing malicious agents to execute arbitrary JavaScript via javascript: URIs supplied through button actions. This affects all three renderers (React, Lit, Angular) enabled by default.

Disclosed 2 October 2026 · Record updated 2 October 2026

Impact

Stored or reflected XSS vulnerability allowing arbitrary JavaScript execution in victim application's browser origin when a user clicks a button with a malicious javascript: URI action supplied by an agent.

Our coverage

A puppet master's strings bypass a security gate, commanding a marionette to execute invisible commands through invisible doorways.

Vulnerabilities

A2UI flaw let agent-supplied buttons run JavaScript in the browser

An advisory published on 2 October 2026 says @a2ui/web_core passed agent-controlled URLs straight to window.open, with no check on the URI scheme.

2 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-72qq-p3r5-f7wq