a2ui/web_core vulnerabilities

CVEs whose affected-version data names the a2ui/web_core package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-10032Medium· 6.1

1mo ago

The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme

The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall ac…

▾ Sunlitgoogle · a2ui/web_coreEPSS 0.20%via NVD