{"action":"Upgrade @a2ui/web_core to 0.10.2 or later.","affected":[{"fixed":"0.10.2","introduced":"0.9.0"}],"component":"@a2ui/web_core","cve_ids":["CVE-2026-10032"],"ecosystem":"npm","epss":0.00125,"exploited":false,"fixed_versions":["0.10.2"],"ghsa_id":"GHSA-72qq-p3r5-f7wq","id":"tcs_01M5KF8HZA0TSCJS3JWC7K725A","modified_at":"2026-10-02T23:15:06.684553771Z","published_at":"2026-10-02T22:55:49Z","references":["https://osv.dev/vulnerability/GHSA-72qq-p3r5-f7wq","https://github.com/a2ui-project/a2ui/security/advisories/GHSA-72qq-p3r5-f7wq","https://nvd.nist.gov/vuln/detail/CVE-2026-10032","https://github.com/a2ui-project/a2ui/pull/1707","https://github.com/a2ui-project/a2ui/commit/71573078c4168b2dc166bb847c3a85715dadc675","https://github.com/a2ui-project/a2ui"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-72qq-p3r5-f7wq","url":"https://osv.dev/vulnerability/GHSA-72qq-p3r5-f7wq"}],"summary":"@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions"}