Product
The @a2ui/web_core package (CVE-2026-10032) contains a critical cross-site scripting (XSS) vulnerability in the openUrl function, allowing arbitrary JavaScript execution via agent-supplied javascript: URIs.