{"vulnerability": "CVE-2026-10032", "sightings": [{"uuid": "b8a29ba8-2a09-4783-acda-535464d73d83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10032", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/j7o7c57m4b5cj", "content": "CVE-2026-10032 - Arbitrary JavaScript Execution via openUrl in @a2ui/web_core\nCVE ID : CVE-2026-10032\n \n Published : Aug. 4, 2026, 3:36 p.m. | 39\u00a0minutes ago\n \n Description : The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() withou...", "creation_timestamp": "2026-08-04T16:48:34.160645Z"}, {"uuid": "86cf4baf-77f2-4d90-9789-7bbfe3d4982a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10032", "type": "seen", "source": "https://gist.github.com/alon710/bbef448ddedc6cabee70ea28e567bc12", "content": "# CVE-2026-10032: CVE-2026-10032: DOM-based Cross-Site Scripting (XSS) via window.open in Google @a2ui/web_core\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-10-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-10032\n\n## Summary\nCVE-2026-10032 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Google's @a2ui/web_core Node.js library. The vulnerability is located within the openUrl utility function, which processes and opens dynamic URLs defined in layout configurations. Because the function fails to sanitize or validate the target URL scheme before passing it to the window.open browser sink, an attacker can specify a javascript: pseudo-protocol to execute arbitrary client-side script in the context of the host origin.\n\n## TL;DR\nUnvalidated URL configuration parameter passing to the window.open sink within the @a2ui/web_core layout engine enables unauthenticated remote attackers to execute arbitrary JavaScript in the victim browser origin.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.1 (Medium)\n- **EPSS Score**: 0.00130 (Percentile: 2.227%)\n- **Impact**: Execution of arbitrary JavaScript under victim origin (XSS)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @a2ui/web_core npm library\n- **@a2ui/web_core**: >= 0.9.0, < 0.10.2 (Fixed in: `0.10.2`)\n\n## Mitigation\n\n- Upgrade @a2ui/web_core dependency to version 0.10.2 or higher.\n- Implement a Content Security Policy (CSP) that restricts 'unsafe-inline' scripts.\n- Validate and sanitize layout JSON configurations on the server-side before serving them to clients.\n- Ensure all window opening implementations enforce 'noopener,noreferrer' attributes to mitigate reverse tab-nabbing.\n\n**Remediation Steps:**\n1. Open the package.json file of your project.\n2. Locate the '@a2ui/web_core' dependency entry under dependencies.\n3. Update the version string to '^0.10.2'.\n4. Run 'npm install' or 'yarn install' to pull the patched version.\n5. Validate the upgrade by executing security test suites against layout renderers.\n\n## References\n\n- [GitHub Security Advisory GHSA-72qq-p3r5-f7wq](https://github.com/a2ui-project/a2ui/security/advisories/GHSA-72qq-p3r5-f7wq)\n- [CVE-2026-10032 Record](https://www.cve.org/CVERecord?id=CVE-2026-10032)\n- [Patch Commit](https://github.com/a2ui-project/a2ui/commit/71573078c4168b2dc166bb847c3a85715dadc675)\n- [Pull Request #1707](https://github.com/a2ui-project/a2ui/pull/1707)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-10032) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-02T23:30:28.000000Z"}]}