CVE-2026-109131 Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)

The Hub collection module documentation renderer in the unified Ansible Automation Platform UI built from upstream ansible-ui, frontend/hub renders a documentation URL part formatPartURL in DocumentationParsers.tsx as a link without restricting the URL protocol/scheme. A collection whose...

CVE-2026-109131 Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)

The Hub collection module documentation renderer in the unified Ansible Automation Platform UI built from upstream ansible-ui, frontend/hub renders a documentation URL part formatPartURL in DocumentationParsers.tsx as a link without restricting the URL protocol/scheme. A collection whose...

EUVD-2026-102325

The Hub collection module documentation renderer in the unified Ansible Automation Platform UI built from upstream ansible-ui, frontend/hub renders a documentation URL part formatPartURL in DocumentationParsers.tsx as a link without restricting the URL protocol/scheme. A collection whose...

Red Hat Ansible Automation Platform Cross-site Scripting Vulnerability

The Red Hat Ansible Automation Platform UI versions 2.6 and 2.7 have a cross-site scripting vulnerability. This vulnerability stems from the formatPartURL function in the Hub collection module renderer, which does not restrict the URL protocol/scheme. As a result, a storage-type cross-site...