Vendor

A2ui

1 brief RSS

Cross-Site Scripting in @a2ui/web_core via openUrl

The @a2ui/web_core package (CVE-2026-10032) contains a critical cross-site scripting (XSS) vulnerability in the openUrl function, allowing arbitrary JavaScript execution via agent-supplied javascript: URIs.

@a2ui/web_core web-vulnerability xss injection

1t 1c 6d ago