CRITICAL9.3npm
GHSA-72qq-p3r5-f7wq· CVE-2026-10032@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
Modified: 10/2/2026
package
npm/@a2ui/web_core
pkg:npm/%40a2ui/web_core
package
pkg:npm/%40a2ui/web_core
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
Modified: 10/2/2026