CVE-2026-10032

The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default.

• CWE-79

• https://github.com/a2ui-project/a2ui/security/advisories/GHSA-72qq-p3r5-f7wqVendor Advisory

Published

Aug 4, 2026

Last Modified

Oct 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100311A vulnerability was identified in mathurvishal CloudClassroo…3.5
• CVE-2026-100312A security flaw has been discovered in mathurvishal CloudCla…6.3
• CVE-2026-100313A weakness has been identified in mathurvishal CloudClassroo…4.3
• CVE-2026-100314A security vulnerability has been detected in mathurvishal C…7.3
• CVE-2026-100315A vulnerability was detected in mathurvishal CloudClassroom-…7.3
• CVE-2026-100316The European VAT Compliance Assistant for WooCommerce plugin…7.2
• CVE-2026-10033The EventON Action User plugin for WordPress is vulnerable t…7.3
• CVE-2026-10034The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable…5.3
• CVE-2026-100347kin-openapi is a Go project for handling OpenAPI files. Prio…5.3
• CVE-2026-100348kin-openapi is a Go project for handling OpenAPI files. Prio…5.3
• CVE-2026-100349kin-openapi is a Go project for handling OpenAPI files. Prio…8.2
• CVE-2026-10035The Turnkey bbPress by WeaverTheme plugin for WordPress is v…6.6