A2UI flaw let agent-supplied buttons run JavaScript in the browser

A vulnerability in the A2UI project's @a2ui/web_core npm package allowed a malicious agent to run arbitrary JavaScript in a victim application's browser, according to a GitHub Security Advisory published on 2 October 2026. The flaw is tracked as CVE-2026-10032 and GHSA-72qq-p3r5-f7wq. It is fixed in web_core version 0.10.2.

A2UI renders user interfaces described by an AI agent. The advisory says the package's openUrl function took a URL supplied by the agent and passed it directly to the browser's window.open call, without checking what kind of URL it was. Browsers treat a javascript: URL as code to execute rather than a page to load. So an agent could put a javascript: URL into the action attached to a Button component, and the code would run when the user clicked that button, inside the origin of the host application. The advisory describes this as stored or reflected cross-site scripting, meaning injected script runs with the trust the browser gives the hosting site.

According to the advisory, no unusual configuration was needed to be exposed. The Basic Catalog, the default set of components and functions that contains openUrl, is enabled by default.

The advisory traces the full path from input to execution. A button accepts an action, the action schema permits a function call, and on click the renderer resolves the value and dispatches it. The catalog then validates the arguments against a schema before running the function. That validation was the weak point: the schema for openUrl required only that url be a string. A javascript: URI is a string, so it passed. There was no allowlist or blocklist of URL schemes at any stage, and window.open was called unconditionally with whatever the agent provided.

All three renderers shipped in the A2UI repository are affected, the advisory says: React, Lit and Angular. Each wires the button's click handler to the same shared action dispatch logic in web_core. The advisory adds that any other A2UI renderer that depends on web_core and uses its basic catalog implementation is also affected.

The fix landed in pull request 1707 in the A2UI repository. According to the advisory, the patched version blocks URLs that do not use the HTTP or HTTPS schemes, and also blocks URLs that cannot be parsed as valid. The advisory asks projects to depend on a version of @a2ui/web_core equal to or greater than 0.10.2.

The advisory cites commit 23a003248abbf59da6c376ea64ace91d82d209ff as the vulnerable code it analysed, and lists the specific source files and line numbers for the sink, the schema and each renderer's button component.

The pattern is a familiar one for agent-driven interfaces. The host application treats the agent's output as data to render, but part of that data is interpreted as code by the browser. Where an agent's output can be influenced by untrusted content it has read, the same button becomes a route for an attacker to reach the user's session. The advisory does not report any exploitation in the wild, and does not say who found the issue.