@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

What happened?

Summary The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS. No non-default configuration is required; the Basic Catalog is enabled by def

Key details

• A malicious agent can supply a javascript: URI via a Button component's functionCall action, leading to arbitrary JavaScript execution when clicked.
• The Zod schema for openUrl only requires a string value, allowing javascript: URIs to pass validation without rejection.
• The issue was fixed in version 0.10.2 by blocking URLs that do not use HTTP or HTTPS schemes or are invalid.

Summarised by SecOraLens from GitHub Security Advisories. Always read the original source before acting. How SecOraLens verifies advisories.