{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10032", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "state": "PUBLISHED", "assignerShortName": "Google", "dateReserved": "2026-05-28T18:45:17.761Z", "datePublished": "2026-08-04T15:36:45.199Z", "dateUpdated": "2026-08-04T17:43:20.898Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2026-08-04T15:36:45.199Z"}, "title": "Arbitrary JavaScript Execution via openUrl in @a2ui/web_core", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-244", "descriptions": [{"lang": "en", "value": "CAPEC-244 Embedded Injection"}]}], "affected": [{"vendor": "Google", "product": "@a2ui/web_core", "versions": [{"status": "affected", "version": "0.9.0"}, {"status": "affected", "version": "0.9.1-alpha.0"}, {"status": "affected", "version": "0.9.1-alpha.1"}, {"status": "affected", "version": "0.9.1-alpha.2"}, {"status": "affected", "version": "0.9.1-alpha.3"}, {"status": "affected", "version": "0.9.1-alpha.4"}, {"status": "affected", "version": "0.9.1-alpha.5"}, {"status": "affected", "version": "0.9.1"}, {"status": "affected", "version": "0.9.2"}, {"status": "affected", "version": "0.10.0"}, {"status": "affected", "version": "0.10.1"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default."}]}], "references": [{"url": "https://github.com/a2ui-project/a2ui/security/advisories/GHSA-72qq-p3r5-f7wq"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-04T17:42:13.437105Z", "id": "CVE-2026-10032", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T17:43:20.898Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10032", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-04T17:42:13.437105Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T17:42:44.203Z"}}], "cna": {"title": "Arbitrary JavaScript Execution via openUrl in @a2ui/web_core", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-244", "descriptions": [{"lang": "en", "value": "CAPEC-244 Embedded Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Google", "product": "@a2ui/web_core", "versions": [{"status": "affected", "version": "0.9.0"}, {"status": "affected", "version": "0.9.1-alpha.0"}, {"status": "affected", "version": "0.9.1-alpha.1"}, {"status": "affected", "version": "0.9.1-alpha.2"}, {"status": "affected", "version": "0.9.1-alpha.3"}, {"status": "affected", "version": "0.9.1-alpha.4"}, {"status": "affected", "version": "0.9.1-alpha.5"}, {"status": "affected", "version": "0.9.1"}, {"status": "affected", "version": "0.9.2"}, {"status": "affected", "version": "0.10.0"}, {"status": "affected", "version": "0.10.1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/a2ui-project/a2ui/security/advisories/GHSA-72qq-p3r5-f7wq"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default.", "supportingMedia": [{"type": "text/html", "value": "The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2026-08-04T15:36:45.199Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10032", "state": "PUBLISHED", "dateUpdated": "2026-08-04T17:43:20.898Z", "dateReserved": "2026-05-28T18:45:17.761Z", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "datePublished": "2026-08-04T15:36:45.199Z", "assignerShortName": "Google"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "@a2ui/web_core", "vendor": "Google", "versions": [{"status": "affected", "version": "0.9.0"}, {"status": "affected", "version": "0.9.1-alpha.0"}, {"status": "affected", "version": "0.9.1-alpha.1"}, {"status": "affected", "version": "0.9.1-alpha.2"}, {"status": "affected", "version": "0.9.1-alpha.3"}, {"status": "affected", "version": "0.9.1-alpha.4"}, {"status": "affected", "version": "0.9.1-alpha.5"}, {"status": "affected", "version": "0.9.1"}, {"status": "affected", "version": "0.9.2"}, {"status": "affected", "version": "0.10.0"}, {"status": "affected", "version": "0.10.1"}]}], "source": "cve-coordination@google.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:a2ui\\/web_core:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "352DFD87-AAE0-45C1-8DB8-A4523D84522E", "versionEndExcluding": "0.10.2", "versionStartIncluding": "0.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default."}, {"lang": "es", "value": "La funci\u00f3n openUrl en @a2ui/web_core pasa una URL controlada por un agente directamente a window.open() sin validar el esquema URI. Un agente malicioso puede proporcionar una URI javascript_disabled: como el argumento url de la acci\u00f3n functionCall de un componente Button. Cuando el usuario hace clic en el bot\u00f3n renderizado, se ejecuta JavaScript arbitrario en el origen del navegador de la aplicaci\u00f3n v\u00edctima, lo que constituye un XSS almacenado/reflejado con una severidad Cr\u00edtica. No se requiere ninguna configuraci\u00f3n no predeterminada; el Cat\u00e1logo B\u00e1sico est\u00e1 habilitado por defecto."}], "id": "CVE-2026-10032", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve-coordination@google.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10032", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-04T17:42:13.437105Z", "version": "2.0.3"}}]}, "published": "2026-08-04T16:16:20.983", "references": [{"source": "cve-coordination@google.com", "tags": ["Vendor Advisory"], "url": "https://github.com/a2ui-project/a2ui/security/advisories/GHSA-72qq-p3r5-f7wq"}], "sourceIdentifier": "cve-coordination@google.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cve-coordination@google.com", "type": "Secondary"}]}

{}