EUVD-2026-52744
GHSA-w72q-x6w3-7rj3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because agent requires write access to functionCall URL parameter; S:C and C:H/I:H reflect full JavaScript execution in application origin; UI:R for required user click.
Primary rating from Vendor (Google).
CVSS VectorVendor: Google
Lifecycle Timeline
1DescriptionCVE.org
The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default.
AnalysisAI
URI scheme injection in @a2ui/web_core's openUrl function enables stored or reflected XSS by allowing an agent-controlled javascript: URI to be passed directly to window.open() without validation. Any application using the Button component's functionCall action on default deployments is affected, since the Basic Catalog is enabled with no special configuration required. CVSS 4.0 impact metrics VC:H/VI:H confirm full confidentiality and integrity compromise at the vulnerable-system level; no active exploitation is confirmed (CVSS E:U, no CISA KEV listing).
Technical ContextAI
The @a2ui/web_core library (CPE: cpe:2.3:a:google:@a2ui/web_core:*:*:*:*:*:*:*:*) provides UI components for web applications, including a Button component that accepts a functionCall action with a url parameter routed through the openUrl function. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): openUrl forwards the url argument to the browser-native window.open() without an allowlist or scheme check. Because browsers interpret javascript: URIs passed to window.open() as executable scripts, an attacker who controls the url argument can stage a cross-site scripting payload that runs under the victim application's full origin. The Basic Catalog being on by default means every standard deployment exposes the vulnerable code path without any operator action. Note: the CPE vendor field lists 'google' - this appears to reflect Google as the reporter, not the vendor; the authoritative project is a2ui-project on GitHub.
RemediationAI
Consult the GitHub Security Advisory GHSA-72qq-p3r5-f7wq at https://github.com/a2ui-project/a2ui/security/advisories/GHSA-72qq-p3r5-f7wq to obtain the exact patched version of @a2ui/web_core and upgrade immediately - no confirmed fix version number is available from currently ingested data, so that advisory is the authoritative source. As a compensating control where immediate upgrade is not possible, applications should apply allowlist-based URI scheme validation in the layer that feeds URL arguments to the Button component's functionCall action, explicitly rejecting javascript:, data:, and vbscript: schemes and permitting only https: and http:. This application-layer guard can be implemented without modifying the library itself but introduces maintenance overhead and must be applied at every call site. Disabling the Basic Catalog is not recommended as a workaround because it disrupts default application functionality and the vulnerable path can be reached through normal component use.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today