CVE-2026-106101

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components...

CVE-2026-106101 Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components...

EUVD-2026-93516

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components...

CVE-2026-106101

The Quasar Framework (prior to version 2.32.2 ) is vulnerable to a DOM Clobbering issue in the openURL() utility located in ui/src/utils/open-url/open-url.js. In an iOS environment, the utility incorrectly trusts window.SafariViewController if the global exists. An attacker can provide attacker-c...

EUVD-2026-52744

@a2ui/webcore: openUrl permits javascript: URI execution via agent-supplied button actions...

GHSA-72QQ-P3R5-F7WQ @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Summary The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitra...

@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Summary The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitra...

CVE-2026-92216

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The proje...

CVE-2026-92216 a2ui-project a2ui Binder generic-binder.ts openUrl redirect

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The proje...

CVE-2026-92216

a2ui-project a2ui versions up to 0.10.7 are affected by an open redirect vulnerability in the openUrl function of the Binder component (file: renderers/web_core/src/v0_9/rendering/generic-binder.ts). An attacker can launch the attack remotely by manipulating the openUrl function to redirect to an...

CVE-2026-92216 a2ui-project a2ui Binder generic-binder.ts openUrl redirect

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The proje...

EUVD-2026-80077

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The proje...

PT-2026-93255

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web core/src/v0 9/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The...

CVE-2026-92216: URL Redirection to Untrusted Site

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The proje...

Improper Restriction of Rendered UI Layers or Frames

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the OpenURL navigation path, which allows a sandboxed iframe withou...

GHSA-9F4C-93C8-JC8G Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Impact A sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in...

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Impact A sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in...

Improper Restriction of Rendered UI Layers or Frames

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the OpenURL navigation path, which allows a sandbox...

NPM: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

NPM: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

CVE-2026-70608

Summary: Electron before versions 39.8.10, 41.10.3, and 42.0.1 allowed a sandboxed iframe without the allow-popups keyword to open a new window or trigger setWindowOpenHandler with no user interaction via OpenURL navigation, bypassing the iframe popup restriction. What’s affected: Electron apps e...