@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Summary The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitra...

EUVD-2026-52744

@a2ui/webcore: openUrl permits javascript: URI execution via agent-supplied button actions...

PT-2026-105490

Summary The openUrl function in @a2ui/web core passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button,...

Cross-site Scripting (XSS)

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

CVE-2026-76982

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it write...

CVE-2026-76982 Apache Wicket: XSS in Button via its model object

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it write...

EUVD-2026-68489

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it write...

CVE-2026-76982 Apache Wicket: XSS in Button via its model object

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it write...

CVE-2026-76982

Apache Wicket is vulnerable to a cross-site scripting (XSS) issue in the Button component (and its subclasses AjaxButton, AjaxFallbackButton, and WizardButton). The root cause: the Button constructor clears the escape-model-strings flag to prevent double-encoding of the value attribute on elemen...

PT-2026-83794

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 6.25.0 through 8.18.0 Apache Wicket versions 7.5.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0 Description Improper neutralization of input during web page...

GHSA-W72Q-X6W3-7RJ3 Duplicate Advisory: @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72qq-p3r5-f7wq. This link is maintained to preserve external references. Original Description The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the U...

CVE-2026-10032 Arbitrary JavaScript Execution via openUrl in @a2ui/web_core

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

PT-2026-67730

Name of the Vulnerable Software and Affected Versions @a2ui/web core affected versions not specified Description The openUrl function fails to validate the URI scheme before passing a URL to window.open. A malicious agent can provide a javascript: URI via the url argument of a Button component's...

CVE-2026-10032: Improper Neutralization of Input During Web Page Generation

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

PT-2026-105545

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72qq-p3r5-f7wq. This link is maintained to preserve external references. Original Description The openUrl function in @a2ui/web core passes an agent-controlled URL directly to window.open without validating the...

OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. There were security vulnerabilities in the versions of OpenClaw from 2026.2.14 to 2026.3.24. These vulnerabilities stemmed from inconsistent application of Discord button and component interactions in channels and...

CVE-2026-29048

HumHub is an Open Source Enterprise Social Network. In version 1.18.0, a cross-site scripting vulnerability was identified in the Button component of version 1.18.0. Due to inconsistent output encoding at several points within the software, malicious scripts could be injected and executed in the...

CVE-2026-29048

HumHub is an Open Source Enterprise Social Network. In version 1.18.0, a cross-site scripting vulnerability was identified in the Button component of version 1.18.0. Due to inconsistent output encoding at several points within the software, malicious scripts could be injected and executed in the...

CVE-2026-29048 HumHub: XSS in Button component

HumHub is an Open Source Enterprise Social Network. In version 1.18.0, a cross-site scripting vulnerability was identified in the Button component of version 1.18.0. Due to inconsistent output encoding at several points within the software, malicious scripts could be injected and executed in the...

CVE-2026-29048 HumHub: XSS in Button component

HumHub is an Open Source Enterprise Social Network. In version 1.18.0, a cross-site scripting vulnerability was identified in the Button component of version 1.18.0. Due to inconsistent output encoding at several points within the software, malicious scripts could be injected and executed in the...