| Package | Affected versions | Patched versions |
|---|---|---|
| a2ui/web core | ≥ 0.9.0, < 0.10.2 | 0.10.2 |
| @a2ui/web_core | ≥ 0.9.0, < 0.10.2 | 0.10.2 |
The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS. No non-default configuration is required; the Basic Catalog is enabled by default.
The vulnerability exists in the openUrl function implementation within the Basic Catalog of @a2ui/web_core (commit 23a003248abbf59da6c376ea64ace91d82d209ff).
Sink — renderers/web_core/src/v0_9/basic_catalog/functions/basic_functions.ts:428-430:
export const OpenUrlImplementation = createFunctionImplementation(OpenUrlApi, args => {
if (args.url && typeof window !== 'undefined' && window.open) {
window.open(args.url, '_blank');
}
});
window.open is called unconditionally with the agent-supplied args.url value. No scheme allowlist or blocklist is applied.
Insufficient schema validation — renderers/web_core/src/v0_9/basic_catalog/functions/basic_functions_api.ts:453-458:
export const OpenUrlApi = {
name: 'openUrl' as const,
returnType: 'void' as const,
schema: z.object({
url: z.preprocess(v => (v === undefined ? undefined : String(v)), z.string()),
}),
};
The Zod schema only requires a string; javascript: URIs pass validation without any rejection.
Full source-to-sink data flow:
renderers/web_core/src/v0_9/basic_catalog/components/basic_components.ts:356 — ButtonApi accepts action: ActionSchema (entry point).renderers/web_core/src/v0_9/schema/common-types.ts:126-130 — ActionSchema permits { functionCall: FunctionCallSchema }.renderers/web_core/src/v0_9/rendering/generic-binder.ts:243-255 — on click, bound action calls resolveDeepSync then dispatchAction.renderers/web_core/src/v0_9/rendering/data-context.ts:93-105 — resolveDynamicValue detects the call key and invokes the named function.renderers/web_core/src/v0_9/catalog/types.ts:177-186 — catalog invoker runs fn.schema.parse(rawArgs) then fn.execute().renderers/web_core/src/v0_9/basic_catalog/functions/basic_functions_api.ts:453-458 — OpenUrlApi validates url as z.string() only (no scheme check).renderers/web_core/src/v0_9/basic_catalog/functions/basic_functions.ts:428-430 — sink: window.open(args.url, '_blank') executes the javascript: URI.All three renderers implemented in the A2UI repository are affected:
renderers/react/src/v0_9/catalog/basic/components/Button.tsx:33 — onClick={props.action}renderers/lit/src/v0_9/catalogs/basic/components/Button.ts:112 — @click=${() => props.action()}renderers/angular/src/v0_9/catalog/basic/button.component.ts:103-110 — handleClick() → dataContext.resolveAction → dispatchActionAny other A2UI renderer which depends on web_core and uses its basic catalog implementation is also affected.
The issue was fixed in https://github.com/a2ui-project/a2ui/pull/1707 and released in web_core version 0.10.2, by blocking URLs that do not use the HTTP or HTTPS schemes, or those that are invalid.
Please fix this issue in your project by depending on a @a2ui/web_core version equal or greater than 0.10.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free