A2Ui Web Core
Monthly
URI scheme injection in @a2ui/web_core's openUrl function enables stored or reflected XSS by allowing an agent-controlled javascript: URI to be passed directly to window.open() without validation. Any application using the Button component's functionCall action on default deployments is affected, since the Basic Catalog is enabled with no special configuration required. CVSS 4.0 impact metrics VC:H/VI:H confirm full confidentiality and integrity compromise at the vulnerable-system level; no active exploitation is confirmed (CVSS E:U, no CISA KEV listing).
URI scheme injection in @a2ui/web_core's openUrl function enables stored or reflected XSS by allowing an agent-controlled javascript: URI to be passed directly to window.open() without validation. Any application using the Button component's functionCall action on default deployments is affected, since the Basic Catalog is enabled with no special configuration required. CVSS 4.0 impact metrics VC:H/VI:H confirm full confidentiality and integrity compromise at the vulnerable-system level; no active exploitation is confirmed (CVSS E:U, no CISA KEV listing).