EUVD-2026-52744

@a2ui/webcore: openUrl permits javascript: URI execution via agent-supplied button actions...

GHSA-72QQ-P3R5-F7WQ @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Summary The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitra...

@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Summary The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitra...

CVE-2026-92216

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The proje...

CVE-2026-92216 a2ui-project a2ui Binder generic-binder.ts openUrl redirect

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The proje...

CVE-2026-92216

a2ui-project a2ui versions up to 0.10.7 are affected by an open redirect vulnerability in the openUrl function of the Binder component (file: renderers/web_core/src/v0_9/rendering/generic-binder.ts). An attacker can launch the attack remotely by manipulating the openUrl function to redirect to an...

EUVD-2026-80077

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The proje...

CVE-2026-92216 a2ui-project a2ui Binder generic-binder.ts openUrl redirect

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The proje...

CVE-2026-92216: URL Redirection to Untrusted Site

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The proje...

PT-2026-93255

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web core/src/v0 9/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The...

Improper Restriction of Rendered UI Layers or Frames

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the OpenURL navigation path, which allows a sandboxed iframe withou...

GHSA-9F4C-93C8-JC8G Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Impact A sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in...

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Impact A sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in...

Improper Restriction of Rendered UI Layers or Frames

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the OpenURL navigation path, which allows a sandbox...

NPM: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

NPM: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

CVE-2026-70608

Summary: Electron before versions 39.8.10, 41.10.3, and 42.0.1 allowed a sandboxed iframe without the allow-popups keyword to open a new window or trigger setWindowOpenHandler with no user interaction via OpenURL navigation, bypassing the iframe popup restriction. What’s affected: Electron apps e...

CVE-2026-70608 Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...

CVE-2026-70608 Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...

Duplicate Advisory: @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72qq-p3r5-f7wq. This link is maintained to preserve external references. Original Description The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the U...

CVE-2026-10032

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...